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SPACE SHUTTLE AVIONICS 
A REDUNDANT IMU ON-BOARD CHECKOUT 
AND REDUNDANCY MANAGEMENT SYSTEM 
(INTERIM REPORT) 

ABSTRACT 

The results of the twelve month study for the NASA/Marshall Space Flight Center 
by the Charles Stark Draper Laboratory Division of MIT are reported. 

This work develops a failure detection and isolation philosophy applicable to multiple 
"off-the-shelf" gimbaled IMUs. The equations developed are implemented and 
evaluated with actual shuttle trajectory simulations. The results of these simula- 
tions are presented for both powered and unpowered flight phases and at operation- 
al levels of four, three, and two IMUs. A multiple system checkout philosophy is 
developed and simulation results presented. The final task develops a laboratory 
test plan and defines the hardware and software requirements to implement an actual 
multiple system and evaluate the interim study results for space shuttle application. 
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1.0 INTRODUCTION 


This is an interim report on the Space Shuttle Avionics Study, NASA/MSFC Contract 
NAS8- 27624. This contract was awarded to the Draper Laboratory of M.I.T. on 
July7, 1971. Asset forth in the statement of work, the study objective was summarized 
in the following sentences: 

"To define an onboard checkout, failure detection, isolation and 
redundancy management scheme for a redundant IMU system 
that meets a fail operational/fail operation /fail safe(FO/FO/ 

FS) criterion. In addition an experimental program that will 
implement the onboard checkout, failure detection, isolation 
and redundancy management scheme will be defined. " 

The approach taken to study the failure detection and isolation (FDI) accuracy 
requirements was to use actual shuttle mission trajectory simulations with defined 
terminal accuracy requirements. Acceptable threshold requirements for evaluation 
of FDI implementations were then defined by showing the accuracy requirements of 
individual system coefficients in each trajectory phase and observing error propaga- 
tion characteristics in position and velocity. By use of actual trajectory phases 
and required IMU characteristics to meet terminal accuracy requirements, threshold 
requirements for the multiple system FDI were obtained. This formed the basis of 
all FDI evaluations. 

The requirement of a failure operational /failure operational/ failure safe capability 
(FO/FO/FS) defines a system of at least four complementary IMUs where failure 
detection and isolation must be reliably accomplished, within mission accuracy 
thresholds, with any pair of operational systems. Notice, five IMUs are required 
for FO/FO/FS if two IMU skewed FDI capability is not assumed. Only this depth of 
gimbaled system FDI will permit a final true fail safe capability. It snould be noted 
that the current shuttle concept is FO/FS implying at least a three IMU system 
definition. The FDI technique presented is directly applicable to this definition. 
Reliability considerations for the shuttle missions are presented in Chapter 2, where 
the probability of mission success with various redundancy levels are described. 
The influence of single IMU reliability (MTBF) and FDI effectiveness on these 
calculations is shown. 

Another primary study area will define, in both hardware and software terms, the 
requirements to implement a laboratory test plan at NASA/MSFC designed to prove 
the concepts developed in this program. 
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It should be noted that this study assumes "off-the-shelf" IMU technology and does 
not attempt to use the unique features of any IMU manufacturer in implementing 
the redundancy performance isolation logic. Simultaneous gimbal readouts and 
reference triad incremental velocity information is assumed to be available from 
each operational IMU. Thus, the FDI methods presented here are compatible with 
all developed aircraft inertial systems. 

1.1 TASK I REQUIREMENTS 

1.1.1 FDI Theory (Powered And Unpowered Flight Phases) 

It should be observed that the operational IMU systems under consideration in this 
paper have good quality, finely quantized velocity loops in common. In contrast, 
the present gimbal angle readout chains involve a low quality single speed synchro 
as a primary sensor. In addition, they have poor gimbal orthogonality and synchro 
null repeatability and use a four-gimbal mechanization with only a three-gimbal 
readout capability. Thus, emphasis in this study is concentrated upon failure detection 
and isolation methods using velocity as the primary source of decision information. 
In unpowered flight phases, of course, attitude chain information is all that is available 
for monitoring the IMU gyroscopes to insure performance levels commensurate 
with later mission phase performance requirements. 

In outlining the requirements for the redundant gimbaled inertial measurement unit 
FDI problem, consideration of all shuttle mission phases, including both powered 
and unpowered flight, is required. In powered flight phases, an FDI technique is 
employed utilizing only incremental inertial velocity information on an axis by axis 
basis. During unpowered flight, only gimbal generated attitude information is 
available for FDI evaluation. 

1.1. 1.1 Hard Failure Philosophy 

In addition to supplementary IMU status information from electronic hard failure 
detection available for the computer, an additional hard failure logic level is 
implemented in software to insure data reasonability. Gimbal angle readouts and 
incremental velocity information are verified for reasonability with respect to 
maximum expected levels prior to any attitude control or navigation updates. Both 
of these hard failure detection implementations serve as additional detection and 
isolation information to permit better management and thus provide more reliability 
in the (soft) performance failure detection and isolation processing. 
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1 . 1 . 1 . 2 Soft Failure FDI Implemented For 4, 3, 2 IMU Operation 

The powered flight phases use individual IMU systems operating with stable member 
reference axes and gimbal axes approximately colinear. This configuration is used 
for both first and second failure detection and isolation capabilities. 

After second failure isolation is accomplished, in a four IMU system, detection of 
a third failure is possible. In order to properly isolate this failure, however, one 
of the two remaining IMUs must be torqued out of the colinear configuration into a 
skewed instrument axes orientation. In this manner, enough redundant information 
is generated on an instrument axis basis to enable achievement of an acceptable 
isolation confidence level. The fail safe criterion set forth earlier is met only 
when instrument failure isolation is possible in a two IMU configuration. 

The colinear alignment at launch of the multiple IMUs permits each system to have 
its stable member independently aligned in the earth reference frame. Aircraft 
navigators have been well developed in this area and do an excellent job. It would 
be possible to torque all stable members into a defined skew orientation frame, 
before launch after prelaunch alignment or to perform initial alignment directly to 
skewed orientations. It is felt this would unnecessarily degrade the inherent IMU 
accuracy due to torquing uncertainties. It would complicate and degrade the sensitivity 
of the resultant FDI and the associated velocity information used for navigation. 
To purposely degrade the available colinear FDI to a skew orientation FDI before 
it is absolutely required would increase the overall IMU accuracy requirements. 
This could show up as a decrease of the resulting FDI reliability or would increase 
overall IMU performance requirements to meet the same mission threshold require- 
ment. One further objection to having all platforms initially colinear is that the 
slewing process will introduce errors through the dynamic error terms (i.e., 
centripetal acceleration, OA coupling, etc.) of the instrument models. A study of 
these rotational terms at angular velocities achievable in the KT-70 indicates that 
such errors are negligible, and need not even be compensated. 

In the unpowered orbital mission phases similar logic is used for colinear and 
two-IMU skew orientations using information on rates derived from the individual 
gyroscope axes. Accelerometer performance is, of course, monitored directly in 
orbital mission phases. 

1.1.2 Prelaunch And Checkout Ties To FDI 

Investigations are made in this study in how best to use the multiple system information 
as an indication of individual IMU parameter verification within expected levels of 
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performance. This is done in the prelaunch verification by investigating the direct 
use of the colinear FDI implementation for individual system integrity testing. 
Another critical prelaunch verification before initializing the powered flight FDI at 
launch concerns a coarse verification within two milliradians of the initial earth 
referenced stable member position between individual IMUs using the gimbal readout 
chains. This is required to insure close stable member alignment on an axis by 
axis basis prior to initialization of the powered flight FDI method. 

1.1.3 Off The Shelf Performance For Shuttle Application 

It has been the intent in this work to establish a method of FDI which is compatible 
with the off-the-shelf IMU, which can be lab demonstrated and which satisfies a 
baselineof accuracy requirements derived for the shuttle mission Itis shownthe pre- 
sent off- the- shelf attitude chain accuracy is marginal to attain the in-flight aligrment 
accuracy requirement prior to the normal reentry mission phase.. Thus, it is of 
prime importance for shuttle application to update the attitude chain hardware and 
develop and demonstrate applicable attitude chain calibration techniques. This is, 
however, not believed to be required directly for the FDI problem solution. 

1.2 TASK II REQUIREMENTS 

The test plan for demonstration of a multiple IMU system at NASA/MSFC is defined 
directly for three production Kearfott KT-70 IMUs and their supporting electronics, 
mated to an IBM 4n--CP2 computer. The computerized test facility available at 
NASA/MSFC, known as SSCMS (Strapdown System Control and Monitor Station)^, 
will be used in monitoring system performance. This facility was designed and 
constructed by the Hamilton Standard System Center. 

The test plan presented includes single IMU calibration and gimbal flip evaluations 
as well as multiple IMU gyrocompassing, land navigation and powered as well as 
unpowered flight FDI demonstrations. 

1.3 FUTURE WORK EFFORT 

An extension to this work was approved on 3 August, 1972. The extension of work 
will be to provide both hardware interfaces and software coding in implementing 
the laboratory demonstration of the multiple IMU system. 
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1.3.1 Task III Work Effort 


The hardware definition is determined principally by given laboratory facilities and 
available operating equipment. Figure 1.1, Proposed Test Configuration , shows 
the system as presently defined. 

The system is based on three KT-70 IMUs with their adapter power supplies. These 
are mounted on a Goerz test table, together with three identical interface units 
(IU/SIUs) and an interconnect box for power and signal distribution. Overhead cables 
will be used for system power and data bus signals. Table slip rings will be used 
for analog signals to be recorded or displayed, such as system voltages and table 
angle information. 

The data bus terminates at a rack mounted processor interface unit (PIU), the 
system's interface with the 4^-CP2 computer. Further, this PIU provides the digital 
link between the 477-CP2 and the test station computer (HP 2116B). 

1.3.2 Task IV Work Effort 

Task IV comprises definition, design, coding and checkout of the operational software 
for the laboratory demonstration system. In addition, certain other software must 
be written: executive routines for the 477-CP2, I/O routines and software interfacing 
with the HP2116B. 

The system demonstration software will be organized in such a way as to contain a 
self-sufficient, independent software package for each major phase of the laboratory 
demonstration. This software will be assembled on a 360/75 using the IBM cross 
assembler. Initial testing will be performed on the 360/75 with a 477-CP2 simulator. 
The majority of the software verification will be performed on the actual 477-CP2 
hardware using a single KT-70 IMU and the hardware interface developed under 
Task III. The laboratory demonstration system software will be modeled as close 
to possible shuttle system software requirements as possible. 
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ROTARY AXIS 

TABLE CONTROL & READOUT 



IU - CONTAINS IU, SIU, POWER SUPPLIES, SYNCHRO/DIGITAL CONVERTERS, TEST POINTS 

ICB - INTERCONNECT BOX-DISTRIBUTION OF POWER & SIGNALS ON THE TABLE 

IMU/APS - ADAPTER POWER SUPPLY MOUNTED OVER IMU 


Fig. 1:1 Proposed Test Configuration. 
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2.0 FAILURE DETECTION AND ISOLATION PHILOSOPHY 

2.1 CURRENT APPLICATIONS OF FDI 

Former space flight equipment, both manned and unmanned, has attempted to meet 
the stringent reliability requirements by use of a simplistic or primary/backup 
philosophy which utilized either ground or crew capability to judge the value of the 
outputs from each system and switch to such alternate systems, methods or plans 
as were available or could be contrived. The basic mission rule was to degrade 
mission goals with apparent equipment problems or to abort with a major equipment 
malfunction. Apollo provided several demonstrations of the effect of this philosophy 
on mission performance. 

Similarly, airline use of inertial navigation equipment, even with dual or triple 
redundancy, relies almost entirely on the crew to provide FDI by monitoring and 
comparing the indications from the inertial navigators and from externally available 
sources of position and velocity data. 

The basic philosophy of the Space Shuttle system of reusable launch and delivery 
vehicles is not compatible with either of the earlier approaches. Each mission 
phase is now required to have a fail operational capability. The rapid decision 
requirements of the critical shuttle mission phases require an advanced approach 
to FDI. 

One method under active development utilizes an integral system of failure detection. 
In this method the output data from the Navigation and Control system is compared 
with precomputed mission reasonability limits. Reliability is provided by automatic 
transfer to a non-failed redundant system whenever the comparison exceeds preset 
values. Unfortunately, a performance degradation which could be critical for space 
shuttle mission safety will not be detected by simple reasonability limit comparisons. 

A second stage in the development of FDI technology is exemplified in the SIRU 
2 

system. This system is a redundant strapdown mechanization utilizing gyroscopes 
and accelerometers mounted on six functional axes arranged in a dodecahedron array. 
The advantage of this arrangement for FDI results from the generation of a self 
contained FDI algorithm based on the output measurements of the individual 
instrument loops. This FDI algorithm automatically screens data to mission 
thresholds at the system update rate. The generation of an instrument operational 
status matrix then permits continuous data processing to a computational triad as 
transformed by a least squares solution. The FDI portion of the SIRU system has 
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been demonstrated in the laboratory environment to be capable of detecting and 

self-isolating performance degradations of less than 0.375°/hr (25 meru) of gyro 

drift and 0.1 cm/ sec of accelerometer bias. This FDI performance is achieved 

utilizing only 4% of the available computer time and 1600 words of memory on a 

DDP-516 computer. The corresponding algorithm update rate is twenty per second, 

which has been shown as satisfactory for the present dynamic models representative 

3 

of the shuttle missions. The redundant configuration of the SIRU system is capable 
of self contained failure detection and isolation of up to two each of the six gyroscopes 
and accelerometers and failure detection of a third instrument of each type. This 
FDI performance closely matches the needs of the space shuttle system. 

2.2 SHUTTLE FDI REQUIREMENTS 

Failure detection and isolation techniques employing redundant gimbal technology 
present a uniquely different problem when implemented at a level commensurate 
with Space Shuttle performance requirements. Basically, the gimbaled system output 
data consists of gimbal angle attitude and incremental inertial velocity information. 
Insight into the solution of the redundant gimbaled technology FDI problem may be 
gained by a close examination of the redundant strapdown system. In the SIRU 
system, gyroscope error drifts as well as accelerometer bias and scale factor errors 
are detected separately by independent gyroscope and accelerometer loop FDI 
implementations. In contrast, gimbal system gyroscope error drifts are reflected 
as changes in both the attitude and velocity output while accelerometer error sources 
appear directly in the velocity output only. 

One other major difference between the redundant strapdown and redundant gimbaled 
problem involves the prelaunch and in-flight alignment sequence. In the fixed 
instrument geometry strapdown implementation, the FDI method is completely 
independent of either prelaunch or in-flight alignment requirements. In contrast, 
the redundant gimbaled system problem requires each IMU to be aligned indepen- 
dently. This independent gyrocompassing in pre-flight is the most accurate method 
available (without the direct use of optics) for aligning the stable member reference 
axes with respect to a known geographic coordinate frame. The gyrocompassing 
reference axis alignment can be further verified by comparing the azimuth attitude 
among inertial units using the available gimbal readout capability. Because of the 
large sensitivity of the inertial velocity information to the launch alignment accuracy, 
the FDI method employed is strongly influenced by initial alignment errors. This 
work assumes that the maximum error in azimuth between inertial system reference 
axes at launch is limited to the gimbal readout capability of the inertial measurement 
"unit employed. 
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In addition to performance failure mechanization, hard failure detection methods 
are implemented for reasonability of incremental inertial velocity and attitude 
information. All failure FDI processing is time synchronized with the attitude control 
and navigation update rate requirements such that all data is screened and evaluated 
prior to processing. 

2.3 IMU RELIABILITY VS. REDUNDANCY REQUIREMENTS 

The actual implementation of all of these redundancy levels requires increasingly 
better IMU system performance parameters as the available redundant information 
decreases. For example, the required IMU performance necessary to operate with 
a two IMU skewed redundancy configuration is more severe than if four or three 
IMU redundancy were available and either configuration has more severe require- 
ments than if a single IMU were specified to operate in a specific mission without, 
redundancy. Indeed, this reasoning implies that the strictly "off-the-shelf" IMU 
technology may be more economically applied at the four or three IMU level (where 
performance requirements approach those required by a single IMU) than at the 
two IMU level where considerable performance improvements in present technology 
may be warranted. This type of tradeoff is, of course, limited by basic simplex 
IMU reliability since at some point further redundancy levels cannot improve overall 
system reliability. 

Survival probabilities, that is, the probabilities of at least one IMU surviving, have 
been calculated and plotted for multiple IMU- systems used in one and two week 
shuttle missions. Imperfect FDI is assumed, with reliability of the FDI ranging 
from 50 to 100%. Individual IMUs are assumed to have identical meantime between 
failure (MTBF) values. For this study, individual IMU MTBF varies over the range 
0 to 2,500 hours. Initial configurations are 5,4,3, 2 and single IMUs operating 
continuously in a parallel configuration. 

FDI effectiveness of x% is taken to mean that, if there is a failure, the probability 
that it is correctly found (detected and isolated) is given by (x/100). Undetected 
and false detected failures imply mission failure. 

Figure 2.1 presents the individual IMU MTBF in order to attain a mission success 
probability of 0.99 with a system consisting initially of three IMUs. It can be seen 
that, as FDI effectiveness decreases, the MTBF required for the individual IMU 
increases for both the 1 and 2 week mission. It should be emphasized when discussing 
MTBF values that the IMU MTBF is dictated by IMU performance screening to the 
required shuttle mission accuracy and is more than a hard failure history of the 
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Figure 2.1- MTBF required for 0. 99 Mission Success 
Probability for 3 IMU System, vs. FDI 
Effectiveness 
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component parts. Typical MTBF values assumed for the ’’off-the-shelf" systems 
being considered in this study, i.e. KT-70 and Carousel, are in the range of 1500 
hours. In this case, a 0.99 probability of mission success may be attained with 
FDI effectiveness ratings of 98% and 70% for the two week and one week missions 
respectively. From this data, it should be observed that the probability of success 
margin for a given IMU MTBF is directly dependent upon the FDI effectiveness. 

Figures 2.2 - 2.6 illustrate the probability of mission success vs. FDI effectiveness 
given the individual IMU MTBF values for systems consisting initially of 5, 4, 3, 2, 
and single IMUs, respectively. Several interesting observations can be made from 
these graphs. First, as the number of IMUs in a system increases, the probability 
of mission success for given individual IMU MTBF values generally increases. 
These increases can be seen to be largest in areas of high FDI effectiveness while 
even small decreases are seen with high MTBFs in areas of low FDI effectiveness. 
This phenomenon is due to the fact that an FDI algorithm with a low effectiveness 
level such as 50% will exhibit more false and missed failures in a system of N 
IMUs than in a system of N-l IMUs. Thus, for a system of five IMUs with MTBF 
of 1000 hours, an FDI algorithm that is 50% effective yields a 2 week mission success 
probability of 0.88 whilea system of four IMUs yields a mission success probability 
of 0.89. 

Finally, it can be seen that for a 2 week mission, a system of three IMUs with an 
individual IMU MTBF value of 1000 hours will not yield a 0.99 probability of success 
even at a 100% FDI effectiveness. A system of four IMUs, on the other hand, as 
well as five IMUs, does meet this 0.99 success probability with MTBF values of 
1000 hours. If a system of three IMUs is employed in the space shuttle, a minimum 
individual IMU MTBF of 1410 hours must be specified in order to attain a mission 
success probability of 0.99 for two week mission times. 
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Figure 2.3- Probability of Mission Success vs. FDI Effectiveness for a System of 
4 IMUs Given Individual IMU MTBF 
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Figure 2. 6 - Probability of Mission Success vs. FDI Effectiveness for a System 
of 1 IMU Given Individual IMU MTBF 


3.0 FAILURE DETECTION AND ISOLATION EQUATION IMPLEMENTATION 

3.1 HARD FAILURE DETECTION AND ISOLATION 

Historically, failure detection and isolation of faulty inertial measurement units 
has been accomplished on an instrument output level. Basically, the individual 
instrument output is checked for reasonableness within some predetermined output 
level limits. A study of all ground test failures experienced in the Apollo Primary 
G&N Inertial Measurement Unit has shown that electronic failure detection capability 
of this type would have isolated less than 30% of the total failures of a level presenting 
problems in the shuttle mission. The largest number of these undetected failures 
lie in the area of degraded instrument performance at a level unacceptable for shuttle 
requirements. 

It is clearly evident that a method must be developed to detect and isolate these 
performance failures. However, it is equally important that a hard fail, electronic 
monitor FDI method be implemented in the shuttle mission so as to detect and isolate 
any unreasonable AS or AV information prior to processing. 

As stated before, implementation of the hard failure electronic monitor is done on 
a reasonability level. For example, the maximum slew rate expected during a normal 
boost phase in the shuttle mission is 10°/sec. If AS indicated a rate higher than 
this, the IMU in question would be failed due to unreasonable data output. 

A 0/At > R + C a R HARD ATTITUDE FAIL (3-1) 

Equation (3-1) represents the hard failure reasonability condition where R is the 
maximum expected mission angular rate, and is a percentage tolerance limit 
for attitude maneuver. 

A hard fail velocity scheme may be developed in much the same manner, i.e., 

AV /At >f +e f »- HARD VELOCITY FAIL (3-2) 

where f represents the maximum specific force expected on the shuttle mission 
and fy represents a percentage tolerance level. 

The choice of and Cy, the percentage tolerance levels for attitude and velocity 
hard failure detection, must be tempered by inherent IMU noise characteristics 
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such a quantization. For example, at maximum specific force inputs, an uncertainty- 
in accelerometer bias of 5 standard deviations should hot signal a hard failure. 


For the test laboratory demonstration proposed in Task II of this study, a maximum 
specific force of lg is seen by the instrument package. Thus, a hard fail detect 
criterion may be presented as 


(AV 2 + AV 2 + AV 2 
x y z 


1/2 


At - 1 g>e 


V 


(3-3) 


where AV , AV , and AV represent incremental accelerometer outputs on the x, 
x y z 

y, and z stable member axes. 


Thehard fail electronic monitors of critical signal levels presently used fordetection 
and isolation are employed by the failure management logic to permit an additional 
decision level to exist, but are not used as a substitute for any performance failure 
detection and isolation level. 


In addition to supplementary IMU status information from electronic hard failure 
detection, a hard failure logic level in the computer is implemented to insure data 
validity. Gimbal angle readout and incremental velocity information must be verified 
for reasonability with respect to maximum expected levels prior to any attitude 
control or navigation updates. Both of these hard failure detection implementations 
serve as additional detection and isolation information to permit better management 
and thus provide more reliability in the parallel performance failure detection and 
isolation software processing. 


3.2 SOFT FAILURE DETECTION AND ISOLATION EQUATION DEVELOPMENT 


3.2.1 Velocity FDI Equations 

The velocity failure detection and isolation equations developed here are consistent 

6 

with realizable redundancy management techniques. To begin with, assume that 
available information consists of a velocity vector in stable member coordinates 
from each operational IMU. An average velocity vector may then be formed as: 

N 

-AVE = zL ~i /N (3_4) 

i = 1 

This average velocity vector is used as an estimate of the true velocity s tate of the 
vehicle. Thus, it will be used as the navigation velocity by the on-board computer 
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for steering updates. Therefore, it will be necessary for all failure detection and 
isolation logic to occur prior to acceptance of the average velocity vector as an 
acceptable multiple system solution. 


In order to detect the presence of a failure, a velocity error of each IMU is established 
with respect to the average velocity vector. 



' -AVE 



(3-5) 


This velocity error vector is an indication of the performance of one IMU with 
r e s pect to all operational IMUs. 


A problem is immediately realized here in that the allowable performance (velocity) 
error will be a function of both mission phase and time into the mission. In order 
to desensitize the error velocity vector to these two variables, equation (3-5) is 
normalized with respect to the total average velocity. 


~ E i 

~ ER i 


(3-6) 


This term, identified as the error ratio, is not directly mission or mission time 
dependent. Equation (3-6) may be written in index notation as: 


V 


ER. . 
U 



-AVE 


(3-7) 


where i indicates the IMU, and j the stable member axis. 


A total squared error may now be defined for each stable member axis as: 

N 

V ET. = 2 V ER. . ( 3 " 8 > 

3 i = 1 1J 

Detection of a failure occurs when this total squared error exceeds a constant known 
as the detection constant. 

V ET. > K d. DETECTION (3 _ g) 

It must be recalled now that the error velocity vector was defined for each IMU as: 
— E i * —AVE ” ^i (3-10) 
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Substituting equation (3-4) into equation (3-10) gives: 



N 

I 

k = 1 


N 


- V. 

— l 


or for a system of four IMUs: 


(3-11) 



— 1 + — 2 + ~3 + ^4 
4 


- V. 

— l 


(3-12) 


It can be seen immediately from equation (3-12) that a bias is introduced into the 
calculation of the error velocity for each IMU due to the definition of the average 
velocity vector, e.g. for i=l 







The true definition of without bias in the measurement, is: 


(3-13a) 


— E , 


—2 + —3 + ~4 


*1 


(3-13b) 


The relationship between and _V'j^ can be expressed as: 




(3-13c) 


Thus, the bias is seen to be 4/3 for a system consisting of four IMUs. More generally, 
the bias may be expressed as (N/N-l) for a system of N operational IMUs. In this 
manner, equation (3-9) must be modified to compensate for this inherent bias. 



(3-14) 


Equation (3-14) represents the true detection condition fora system of N operational 
IMUs. 


Isolation of a detected failure is accomplished by measuring the error of each IMU 
on an axis by axis basis with respect to the total squared error derived in equation 
(3-8). 

y2 

ER.. 

> K t *- ISOLATION (3-15) 

1 

ET. 

. J 


If a major part of the total squared error can be attributed to any one IMU, then a 
failure has been isolated. The choice of an isolation constant to implement this 
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logic decision must be based on several factors including the number of IMUs in 
the system and the acceptable signal to noise ratio. 

A logic flowchart of the velocity soft failure detection and isolation method is shown 
in Figure 3.1. 

3.2.2 Attitude FDI Equations 


The attitude failure detection and isolation equations developed here are expressly 
tailored to a four-gimbal IMU, such as the KT-70. However, implementation of the 
teehnique-to-more-conventional— three- gimbal— IM-Us-presents-no-problem. — To-begin 
with, it is assumed that the only information available from each of the IMUs is the 
gimbal angles. Using these gimbal angles, a quaternion may be developed which 
represents a rotation from the navigation base to the stable member platform. 

Q| M = Q 0 Qj Q 2 Q 3 (3-16) 

i i i i J i 

where Qo-, Qlg Q2g Q3^ are quaternion representations of the four gimbal angles 
for the i^h IMU. It is assumed here no fixed attitude misalignment transformations 

7 

are used to maintain the calibration of each IMU. This is critical in the two IMU 
problems presented in section 3.2.3. 


Since the quaternion developed in equation (3-16) may be represented as: 

t 8 ir \ /8, r \ /9 r 


A SM 

Q b = cos\ 
i 


(^) + i x sin(— t) +- iy sin(-^i) + i z sin(-^) 


(3-17) 


a rotation vector may be defined as: 


SM 

fi B. 

l 


= x 


-x X. 


+ i 


0 +i 

y. ~z 


z. 

l 


(3-18) 


It must be noted here that the rotation vector, is essentially a set of Euler 

angle rotations and, as such, will be represented as a vector for convenience sake 
only. 


An average rotation vector may then be defined as: 

,SM 


N R 


— AVE 2 


•B. 

l 

N 


(3-19) 
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Figure 3.1- Logic Flow Chart of Velocity FDI Technique (Powered Flight) 
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In order to perform vector functions, -fi^y E mus t be transformed into quaternion 
form, i.e. 


Q AVE 



(3-20) 


An error quaternion may now be developed as: 


Q E. = Q AVE Q i 
1 


where 


Q AVE — cos -V 2 


( ave\ . . (® x ave) . . (^ave) . . (Vve) 


(3-21) 


43-22) 


It is once more convenient to return to rotation vector form for the detection and 
isolation process. Therefore, let 


^E 


= i 0 + i 0 + i 0 

! x e. -y y E . _z z e. 

iii 


(3-23) 


from equation (3-21). 


The error rotation vector information is stored in the computer so that time histories 
of the vector may be established. In this manner, a drift vector may be defined as 


DRIFT. 
— i 


*-E. ' ®E LAST . ^ ^ At 


(3-24) 


where i indicates the IMU and AT the time step between measurement 
of R Ei and RELASTi 


By defining the attitude error in terms of a drift rate rather than a whole angle, 
problems involving absolute attitude accuracy are relieved. This is especially 
important in an IMU with inherently poor gimbal readout chains. 


A total squared error may now be derived from equation (3-24) as 

N 

DRIFT^, = ^ DRIFT? (3-25) 

•* i = 1 • j 

where j represents the stable member axes and i the IMU. 

Detection of a failure is accomplished by comparing the total squared error developed 
inequation (3-25) to a predefined detection constant based on maximum performance 
deviations allowable in the system. 

DRIFT^ > K d (3-26) 

3 3 
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As with the velocity failure detection method presented earlier, a bias is introduced 
inthetotal squared error shown in equation (3-25) due to the definition of theaverage 
rotation vector. Thus, equation (3-26) must be implemented as 

DRIFT 2 > ( N ^ -) K d ► DETECTION (3-27) 

3 V ' 3 

Isolation of a detected failure is accomplished, as with the velocity FDI technique, 
by measuring the error of each IMU, on an axis by axis basis, with respect to the 
total squared error. 

DRIFT 2 

X. 

> K »- ISOLATION (3-28) 

DRIFT^, 1 

3 

Like the velocity FDI scheme, the choice of an isolation constant is based on the 
number of operational IMUs in the system and the acceptable signal to noise ratio. 
Theory behind the choice of a proper isolation constant is presented later. 

A logic flow chart of the attitude failure detection and isolation scheme is shown in 
Figure 3.2. Notice, the logic of both methods implemented when error detection 
without the subsequent isolation occurs is to recycle and reverify the detection 
condition. This is the circumstance when simultaneous large errors occur on the 
same IMU axis. It is exactly this circumstance for which a higher level of redundancy 
management must be implemented using the performance failure, hard failure, other 
possible subsystem information and experience on the implemented systems to form 
an operating method acknowledging two simultaneous IMU axis errors. 

3.2.3 Two IMU FDI Equations 

Failure detection and isolation in a system consisting of two colinear gimbaled IMUs 
such as the KT-70 presents a unique problem not encountered in a system of three 
or four colinear IMUs. This problem exists because, while detection of soft failures 
is possible by means already presented herein, isolation of the detected failure 
cannot be accomplished. The problem is circumvented by taking the approach outlined 
earlier, i.e., skew one IMU with respect to the other by an optimum Euler angle 
rotation. In this manner, although only two gimbaled systems are employed, enough 
redundant data is available to properly isolate any detected failure. 

To begin with, assume that available information consists of a velocity vector from 
each operational IMU (two in number) in its respective stable member platform 
coordinates. Since the two IMUs are skewed with respect to each other by a known 
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Figure 3.2 - Attitude Soft Failure Detection and Isolation Logic (Unpowered Flight) 












rotation vector the relationship between the two velocity vectors may be represented 
ideally as: 

— 1 = q o ~2 q o (3-29) 


where is the velocity vector from IMU^, Vg is the velocity vector from IMU 2 , 
and q Q is a quaternion representation of the Euler angle transformation from IMU 2 
stable member coordinates to IMU^ stable member coordinates. 


Given this velocity information, detection of an accelerometer failure may be 
accomplished by utilizing the magnitude difference of the two vectors, i.e.. 




(3-30) 


2 

where V^, is a scalar representative of the total velocity error magnitude. To 

avoid any direct dependence upon the mission being flown, it is convenient to 
9 

normalize V-g by the total squared average velocity, i.e. V .1 Y 2 • Detection of a 
failure in the velocity chain is then accomplished by comparing the normalized 
squared error velocity to a pre-determined detection constant. 


V 


E 


l V ll 


IV. 


> K 


DV 


DETECTION 


(3-31) 


If this scalar exceeds the detection constant, then an attempt to isolate the faulty 
IMU is made. If not, attitude failure detection and isolation logic is entered to 
check the status of all gyroscopes. The flow of this logic can be seen in Figures 
3.3a and 3.3b. 


To isolate a detected accelerometer failure, two velocity error vectors are formed. 

V£ l * Xl - % Y 2 % (3 - 32a > 

VE 2 » V 2 - q* Vj q o (3 — 32 b) 

In equation (3-3 2a), X 2 i- s computationally transformed into a coordinate system 
colinear with that of IMU^. In this manner, VE^ is a vector representative of the 
velocity error in IMUj. Similarly, VE 2 is a vector representative of the velocity 
error in IMU2. If an accelerometer failure has occurred, then a major portion of 
the magnitude of either V. E 1 or VE 2 will lie along a single stable member axis. 
For example, if an accelerometer failure has occurred on the Y-axis of IMU^, then 
a large part of the magnitude of VE^ will liealong the Y-axis. Ina similar manner, 
while this same failure would cause a theoretically identical error in magnitude 
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Figure 3. 3a - Two IMU Failure Detection and Isolation, Velocity Logic 
(Powered Flignt) 
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of however, no major portion of this error would liealongany one stable member 

axis in IMU 2 . This is because the two IMUs are skewed with respect to each other 
and therefore have no two axes colinear. 


To increase the sensitivity of the velocity error vector, a squared error ratio is 
formed as: 




VF. 

2 


1 



> K 


IV 


(3-33) 


where Kjy represents an isolation constant. Choice of the proper isolation constant 
must be made with respect to actual system signal to noise considerations. 


Detection of a gyroscope failure in powered flight is accomplished in a manner 
similar to that of the accelerometer failure just described. To begin with, a 
dimensionless attitude error unit vector is derived for each IMU. 

AE, • (v, * % V 2 q o * ) 

A — 2 = (—2 * % — 1 % ) 

In this manner, AE.j is representative of an error rotation in IMU^ stable member 
coordinates and AEg is representative of an error rotation in IMUg stable member 
coordinates. 


|X_l| 

1^2] 

1 


■ 

3 


(3-34a) 

(3-34b) 


Detection of a gyro failure is accomplished by employing the attitude errors derived 
in equations (3-34a) and (3-34b). A drift vector is defined for each IMU as: 


DRIFT . = ( AE . - AE LAST .) /At 


(3-35) 


In this manner, detection can be based on an acceptable level of drift rather than 
whole error angles. 

DRIFT.. > K-. DETECTION (3-36) 

1J JJA 

Isolation of a detected gyroscope failure is done so as to locate the direction of the 
maximum drift vector. A velocity error vector is formed for each IMU in its 
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respective stable member reference frames after gyro torquing is completed. 

Vfijttj) = V^) - q Q V^t^q* ) (3-37a) 

VE 2 ( t i ) = V 2 (t 1 ) - q 0 V 1 (t 1 )q 0 J (3-37b) 

These velocity error vectors are formed after skewing is completed so as to eliminate 
any gyro torquing scale factor errors which may be inherent in the system. This 
is important since typical gyro torquing scale factor errors are specified to be 
quite large for the Kearfott KT- 70 IMU. 

At the time an unacceptable drift is detected (equation (3-36)), another velocity error 
vector is formed for each IMU in its respective stable member reference frame. 

= - 1 ^ 2 ^ ' q 0 - 2 ^ 2^ q 0 
YE 2 (t 2 ) = V 2 (t 2 )-qQi 1 (t 2 )q 0 


(3-38a) 

(3-38b) 


The stable member axis exhibiting the maximum gyro drift over the time interval 
(t 2 “ t^) may now be found by crossing the two velocity error vectors as 


D RIFT AXIS x = 


VE 1 <t 1 ) X VE^tJ 
lYE^t^ IVEj^) 


(3-39a) 


driftaxis 2 


VE 2 (t 1 )x YE 2 (t 2 ) 

( VE 2 «i)| |VE 2 (‘ 2 ) | 


(3-39b) 


The theory behind use of equation (3- 39 a) and (3- 39b) is that maximum velocity 
deviations over the time interval (t 2 - t^) will lie in a plane perpendicular to the 
maximum gyro drift. The cross product of these two velocity error vectors will, 
therefore, identify the axis of drift over the time interval (t 2 - t^ ). The maximum 
componentof the vectors DRIFT AXIS ^ and DRIFTAXISg isolates the faulty gyroscope 
and thus the faulty IMU. 


MAXIMUM (DRIFTAXIS..) > K IA »^ ISOLATION (3-40) 

It must be noted here that the isolation technique presented above is valid only 
when a drift detection has been positively identified. Probability limits as to the 
decision of a failure are inherent in the isolation constant. As with all previous 
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choices of the isolation constant, signal to noise consideration must be taken into 
account. 


One further failure detection condition must be introduced into the two IMU FDI 
problem to check the IMU attitude error. If a large attitude error is present, the 
velocity FDI technique will not detect it because no great difference in magnitudes 
will exist. Further, the attitude FDI technique will not detect it because no drift is 
occurring. However, the presence of the large IMU attitude error is capable of 
failing mission performance criteria and therefore must be considered. 


In order to detect an unacceptable IMU attitude error the whole- angle offset between 
the two velocity vectors is defined as 


PHI 


VI X V2 

(Hi 


V2 


(3-41) 


If PHI exceeds a whole angle detection constant K^y. 311 unacceptable IMU attitude 
error has been detected, i.e. 


PHI > K D y DETECTION 


(3-42) 


Isolation of a detected failure is done in a manner exactly as all other velocity 
failures (equation (3-36)). It should be noticed here that a preferred order of detection 
is presented as: 

1. velocity magnitude error, 

2. drift errors, and 

3. whole angle errors between velocity vectors. 


This preferred order has been established so as to minimize isolation problems. 
For example, certain accelerometer performance errors could cause a drift failure 
detection condition. Isolation of this failure would be difficult by anything other 
than the velocity vector comparison outlined in equations (3-33) to (3-36), First 
priority should always be a magnitude check, then drift, and finally whole angle 
offset for IMU attitude errors. 

3.3 ISOLATION THEORY 

Choice of a proper isolation constant, as stated earlier, involves the consideration 
of two major items, i.e. signal to noise ratio and the number of operational IMUs 
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in the system. Signal to noise ratio, in this context, represents the ratio of the 
error signal from a single IMU to be isolated to the magnitude of the normally 
expected uncompensated parameter uncertainties from all other operational IMUs 
in the system. Figures 3.4 and 3.5 illustrate the relationship between all possible 
isolation constants and error signal to noise ratios for redundant systems employing 
four and three operational IMUs respectively. It can be seen that the choice of a 
proper isolation constant is well bounded by the probability of missing true failures 
and the probability of isolating false failures. Further, an area controlled by 
instrument noise is evident at low error signal to noise ratios. This phenomenon 
arises due to improper choice of a detection constant. For example, if a detection 
constant is chosen so as to recognize a small error level, the error signal to noise 
ratio will also be small since the errors detected will be of the same order of 
magnitude as the uncompensated parameter uncertainties. Detection at a low error 
signal to noise ratio, therefore, implies that an isolation decision must be made in 
a region controlled by instrument noise. In order to avoid this problem, the detection 
constant must be chosen at a level high enough to permit proper isolation decision 
capabilities. 

If both the detection and isolation constants are chosen properly, under the design 
considerations illustrated in Figures 3.4 and 3. 5 no single failure detection or isolation 
problems will arise. If a specific isolation decision cannot be made, however, multiple 
simultaneous failures have occurred. If simultaneous failures are indicated in an 
FDI implementation with known high reliability then the identification of simultaneous 
failures itself is useful knowledge for implementation with other status information 
for redundancy management. 

3.4 SUMMARY 

The FDI method presented here has several advantages over other failure detection 
and isolation methods. To begin with, during time critical mission phases, the 
technique utilizes only velocity vectors from the IMUs. Thus, the hardware change 
tradeoffs in off-the-shelf four-gimbal inertial measurement units are based upon 
factors other than the redundancy management implementation such as the capability 
of inflight alignment. 

Secondly, the technique does not break down under most multiple simultaneous 
performance failure conditions. Since all detection and isolation is done on an axis 
by axis basis, simultaneous failures on different inertial axes cause no problems 
in the FDI process. If multiple simultaneous failures occur even on the same inertial 
axis, FDI techniques will not break down provided the velocity error propagations 
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are significantly different. Thus, only those performance errors that occur on the 
same inertial axis with similar velocity error propagation characteristics will not 
be isolated. Detection of this multiple failure situation will, however, be ac- 
complished. If this detection is coupled with other hard failure or external 
information, a redundancy management method can be implemented. 
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4.0 FAILURE DETECTION AND ISOLATION SIMULATION DESCRIPTION 

4.1 SHUTTLE TRAJECTORY DESCRIPTION AND MISSION REQUIREMENTS 

The evaluation of a performance failure detection and isolation method, suitable 
for the shuttle mission, requires a variety of mission phases. The critical phases 
with respect to an FDI study are the boost, cruise and entry phases. The trajectories 
chosen for the FDI evaluation, then, are 

1) Boost Trajectory 

'2) Booster Entry Trajectory ~ ~~ 

3) Orbiter Entry Trajectory 

4) Cruise 

The nominal boost trajectory, in the simulations to follow, has a duration of 1302 
seconds prior to orbital insertion, with a launch at Kennedy Space Center. The 
booster profile consists of a 12-second vertical rise followed by a constant pitch 
rate maneuver. The vehicle then flies an approximate zero angle of attack with 
booster acceleration limited to 2. 5 g until staging occurs at 225 seconds. Theorbiter 
stage acceleration is limited to 3g with engine shutdown occurring at 424 seconds. 
The final duration of the boost phase consists of unpowered flight with no vehicle 
rates. The only vehicle acceleration realized in this period is due to the presence 
of atmospheric drag. 

To establish acceptable threshold levels for the FDI problem, some criteria must 
be derived so as to distinguish unacceptable performance from acceptable 
performance. This task is a difficult one for the nominal boost trajectory since 
there is no defined acceptable "footprint" for the vehicle. The maximum allowable 
errors acceptable for IMU performance in a nominal ascent trajectory must be a 
function of whether these errors place the safety of the crew in jeopardy. The 
safe-orbit determination is, therefore, the only valid criterion for establishing 
absolute red-line IMU performance parameters. Whether these parameters are in 
terms of actual instrument performance levels, e.g., 0.9°/hr bias on the east gyro, 
or system performance levels, e.g., velocity error of 50 ft/sec, is of minor concern 
since either may be employed as an acceptable measure of safety. The study of 
four redundant gimbal IMUs, however, requires the use of system performance 
parameters as the criterion since the on-board computational facility will have 
estimated state vectors (one from each IMU) available for use by the failure detection 
and isolation equations. Differences in position, velocity, or attitude among four 
IMU estimated states are thus the only measurements that may be taken. A problem 
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is immediately realized here in that FDI techniques must operate on four estimated 
states in an attempt to meet a criterion based on the true state of the vehicle, 
namely a safe orbit. The establishment of required individual IMU red-line 
performance parameters, therefore, should involve a closed-loop simulation where 
all IMU errors are fed back into the guidance equations of the vehicle so as to 
control the true state. 

Simulations of this type predict minimum instrument error sources that are capable 

g 

of failing the safe-orbit criterion. These results are presented in Table 4.1. 
Note that the gyro bias drift rate specifies two values, i.e. -0.9°/hr and -2.0°/hr. 
The -0.9°/hr represents the maximum allowable drift if this gyro is used for 
gyrocompassing during pre-launch. The -2. 0°/hr represents the maximum allowable 
drift if the gyro is specified only on the basis of the time dependent drift error 
from the time of launch to orbiter engine shutdown, assuming an external method 
of controlling the azimuth error. 

Table 4.1 


Cross Range 
Cross Range 

Cross Range 
Down Range 
Altitude 
Down Range 

It should be remembered that the values given in Table 4.1 represent the minimum 
allowable individual instrument error uncertainties for a single IMU to fail the 
safe-orbit criterion for a nominal ascent trajectory. For the case of four IMUs, 
however, navigation is executed on the basis of the average of the individual outputs. 
Determination of the maximum threshold level tolerable (red-line limit) must then 
be accomplished by observing what system errors are realized in the estimated 
state when the minimum allowable uncompensated instrument error sources presented 
in Table 4.1 are employed in a closed-loop IMU simulation. The results of these 
simulations may be presented in a manner consistent with that proposed in the FDI 
method defined previously, i.e. a time profile of V error/V total where V error is 


Red-Line Instrument Errors 
(Nominal Ascent Trajectories) 


Error Source 


Magnitude 


Gyro Bias Drift -0.9°/hr (-2.0°/hr) 

Gyro A Sensitive Drift About -2.25°/hr/g 
The Spin Axis 


Accelerometer Bias 
Accelerometer Bias 
Accelerometer SF Error 
Accelerometer SF Error 


5.10 cm/ sec 
±3.26 cm/ sec 2 
-6750 ppm 
-2010 ppm 



coordinatized in the launch stable member frame. In addition to a red-line 
performance criterion, an IMU performance criterion is established in much the 
same way. However, instead of red-line values being used in the simulations, 
individual 3 -ct IMU parameter values are used to predict estimated state errors. 
A root sum square (RSS) is then taken of all of the contributions in order to describe 
a "worst case" 3 -ct IMU performance. Figure 4-1 identifies the resultant normalized 
thresholds that were used in the simulation for the nominal boost trajectory. It 
should be noted that pre-launch azimuth gimbal monitoring among IMUs was used 
to limit pre-launch azimuth error to 2 mrad. A shift in the performance failure 
threshold is evident at 225 seconds. This shift is a result of several factors. 
Fir st, instrument error sensitivities are unusually high near the region of maximum 
dynamic pressure. These error sensitivities are found to decrease after staging. 
Secondly, the red-line thresholds as well as the 3 -ct IMU thresholds shown are 
straight-line approximations of the actual thresholds derived. The actual 3 -ct curves 
are also shown. 

After orbiter engine shutdown, only attitude FDI methods are employed. Identification 
of red-line parameters for the attitude FDI evaluation is based upon the required 
gyroscope performance levels specified for the entry mission phase. 

g 

The booster entry trajectory subjects the vehicle, and thus the IMU(s), to a more 
severe dynamic environment and performance requirement than the nominal ascent 
trajectory. The duration of the booster entry trajectory is 600 seconds. The vehicles 
separate at 215 seconds. An apogee of 53.7 miles is reached 50 seconds after 
separation. The vehicle then undergoes a transition maneuver after which it turns 
around and proceeds back to the launch site. Maximum acceleration during the 
entire flight is limited to 4.0g. For simulation purposes, all performance evaluation 
is terminated at an altitude of 50,000 feet. 

Evaluations similar to those for the nominal boost trajectory were accomplished 
for the ‘booster entry trajectory to determine red-line and 3 -ct IMU performance 
specifications. However, the red-line criterion chosen for this trajectory is a 
5 -nautical-mile-radius circle at 50,000-feet altitude. Maximum allowable IMU error 
sources which meet this criterion were derived and are shown in Table 4.2. The 
resultant normalized redline and 3 ct thresholds are shown in Figure 4-2. 
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Figure 4.1 

Nominal Boost Mission Detection Thresholds. 
(Prelaunch Azimuth Error 2.0mrad Max.) 
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Figure 4.2. Booster Entry Mission Thresholds. (Prelaunch Azimuth Error 2 mrad max. ) 


Table 4.2 

Red-line Instrument Errors 
(Booster Entry ) 


Cross Range 
Down Range 
Down Range 
Cross Range 
Cross Range 


Accelerometer Bias 
Accelerometer Bias 
Accelerometer SF Error 
Gyro Bias Drift 
Gyro A Sensitive 
Drift About the Spin Axis 


2 

±2.15 cm/ sec 

2 

±2.86 cm/ sec 
±5200 ppm 
0.1°/hr (4.3°/hr) 

8.4°/hr/g 


The orbiter entry trajectory provides the longest time duration and the most difficult 
performance requirements of all mission phases. The orbiter vehicle is initially 
assumed to be in an equatorial orbit with a deorbit burn maneuver occurring 15 
minutes prior to entry interface. Further, the vehicle is assumed to have performed 
an inflight alignment just prior to the deorbit burn. The orbiter entry employs a 
thermal protection system guidance law 1 which navigates the vehicle along a 
minimum g-loading path. Its configuration consists of a high cross-range capability 
which is utilized 260 seconds after entry interface to perform an attitude maneuver 
which places the vehicle into a 550 nmi cross-range trajectory. A vehicle transition 
maneuver occurs at 90,000-feet altitude. 


Development of red-line and 3-cr performance specifications for the orbiter entry 
trajectory follow the same logic as presented for the nominal boost and booster 
entry trajectory. These performance specifications are shown in Figure 4-3. 

The criterion chosen for the orbiter entry trajectory is a 12-nautical-mile-radius 
circle at 100,000 feet altitude. Maximum allowable IMU error sources that meet 
this criterion are shown in Table 4.3. 


Table 4.3 

Red-line Instrument Errors 
(Orbiter Entry) 


Altitude 
Cross Range 
Down Range 
Altitude 
Altitude 


Accelerometer Bias 
Accelerometer Bias 
Accelerometer Bias 
Accelerometer SF Error 
Gyro Bias Drift 


±1.77 cm/sec 2 
±2.34 cm/ sec 2 
±4.00 cm/sec 2 
9300 ppm 
1.98°/hr 
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Cross Range 
Down Range 
Cross Range 

Down Range 


Gyro Bias Drift 

Gyro Bias Drift 

Gyro A Sensitive 

Drift About the Spin Axis 

Gyro A Sensitive 

Drift About the Spin Axis 

In-flight Alignment 


3.27°/hr 

0.75°/hr 

2.45°/hr/g 

13.50°/hr/g 
±5 mrad 


4.2 REDUNDANT INERTIAL SUBSYSTEM SIMULATION METHOD 


Three basic software subroutines have been developed for the evaluation of the FDI 
methods with shuttle mission requirement. A detailed single four-gimbaled IMU 
model representing existing "off-the-shelf" performance characteristics was 
created. A block diagram of the model is shown in Figure 4-4. The essential 
features can be described as follows: 


1. A perfect state vector of the vehicle with respect to a reference frame is 
derived from the given trajectory inputs. 

2. The computational state vector of the vehicle with respect to a reference frame 
is derived using the gyroscope and accelerometer models. 

3. The actual gimbal readout chain is modeled to generate realistic attitude 

* 

information. 

4. An evaluation process is implemented to demonstrate the performance of the 
actual IMU mechanized. 


This IMU model is used to generate a series of data files, each of which represents 
a single IMUs data output to be utilized in the final multiple IMU simulation. Figure 
4-5 shows the features of the multiple IMU simulation method. It can be seen that 
each IMUs data output is employed with the FDI equation set which is being evaluated. 
In this manner, simulations may be made utilizing any number of IMU models, each 
with different performance characteristics. 

4.2.1 Description of a Single IMU Simulation 

The IMU model that is simulated is described in Appendix A. The IMU model e^ror 
sources discussed below may optionally be specified by data cards, but normally 
are determined by a random number generator with normal distribution, zero mean. 


44 




Figure 4.4 

Gimbaled IMU Model Flow Chart. 
















Figure 4.5 

Multiple I MU Simulation Flow Chart. 














and variance equal to the values listed in Appendix A. Once determined, each error 
source is carried through the mission at this single value. Instrument errors included 
in this simulation are bias drift and acceleration sensitive drift for the gyros, and 
bias and scale factor errors for the accelerometers. Misalignment terms are also 
modeled and simulated. 

The initial platform misalignment represents pre-launch gyro compassing error 
or inflight alignment error. 

The leveling error is proportional to down range and cross range accelerometer 
biases. The azimuth error is dominated by the effective east gyro drift. It has 
been found that the ability to do the prelaunch gyrocompassing directly affects the 
sensitivity of the FDI method. If the standard KT-70 IMU subsystem is assumed, a 
gimbal chain calibration will allow knowledge of the azimuth readout axis of each 
IMU to within two milliradians. The simulation program then limits the azimuth 
error sources in each IMU to two milliradians. 

In the inflight alignment case, the alignment errors and the time from alignment 
are inputted. The initial error is then the sum of the alignment error and the 
gyroscope bias drift multiplied by the time from alignment. 

For simplicity, the accelerometer triad misalignment is specified by three angles. 
One angle specifies the nonperpendicularity of the two level accelerometers relative 
to each other. The other two angles indicate the nonperpendicularity of the radial 
accelerometer relative to the level plane. 

Gimbal-non-orthogonalities and the redundant gimbal bias are specified by five 
separate quaternions. The gimbal readout model allows quantization error, constant 
readout bias, and a sinusoidal readout error which varies as a function of gimbal 
angle. 

Referring to Figures 4-6aand 4-6b,the IMU simulator program will now be defined. 
This program simulates the four gimbal KT-70 and a dedicated navigation computer. 
The output is a file of IMU measurements and navigation quantities. 

The values of the IMU model error sources are determined at the beginning of 
each run. In the cases of the "perfect" IMU these values are introduced by data 
cards specifying all zeros. The "red line" IMUs are generated by selectively 
introducing the required error values. 
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The simulation loop reads a mission phase trajectory file. These files contain 
specific force in body coordinates, body rate in body coordinates and time. The 
average specific delta velocity in body coordinates due to the rotation of the vehicle 
is computed. This is then transformed into "perfect" stable member inertial 
coordinates. The transformation from body to perfect stable member is updated 
as a function of body rate. The specific AV is then transformed into actual stable 
member coordinates by the quaternion representing gyroscope errors. This error 
quaternion is then updated as a function of gyroscope bias, and acceleration sensitive 
drift. The accelerometer outputs are the specific AV degraded by accelerometer 
bias, non-orthogonalities, scale factor errors and quantization. Position and velocity 
are then updated by the accelerometer outputs after gravity computer processing. 

Gimbal angles are extracted from the body to actual stable member quaternion using 
Newton's method of iteration. This process automatically considers fixed gimbal 
non-orthogonalities. The gimbal readout model then degrades these angles 
considering readout bias and sinusoidal offset error models and the quantization 
error of the readout device. The simulation program writes an output file of gimbal 
angles, accelerometer outputs, position, velocity and time. 

These procedures are performed periodically, and synchronized with the trajectory 
file, until the mission is completed. 

4.3 FAILURE DETECTION AND ISOLATION IMPLEMENTATION 

The four IMU failure detection and isolation encompasses two methods corresponding 
to powered and unpowered flight. The two programs used to implement and verify 
these methods will be described below. These programs have been run with boost, 
entry and coasting flight trajectories, with one, two and three IMU failures. The 
result of these simulations will be discussed in the next section. Both of these 
analysis programs require five IMU files. One file represents the perfect IMU. 
The other four represent the four operational IMUs. There may be one, two or at 
most three separate red line IMUs, while the remaining IMUs represent normal 
"one sigma" performance models. 

4.3.1 Velocity FDI Verification Program (Powered Flight) 

The following is a description of the velocity FDI Verification Program, to be used 
in conjunction with Figures 4-7a to 4-7c. The program reads detection and isolation 
threshold constants which depend on mission phase and were established as shown 
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Figure 4 -7a Velocity FDI Verification Program Flow Diagram 
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Figure 4-7c Velocity FDI Verification Program Flow Diagram 
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in 4-6a. The position and velocity are also initialized with respect to each separate 
mission. 

Velocity and AV for the four operational and the perfect IMUs are read from the 
datafile. The perfect 1MU data is used only for performance verification and display 
and does not enter into FDI computations. 

At each time step, a reasonability test on AV is made to isolate hard failures. 

The first step in the FDI computation is to determine the average velocity of the 
remainder of the "good" IMUs, i.e. those IMUs not failed by reasonability criteria. 
An estimate of the individual IMU velocity errors is computed relative to this average 
velocity. TSE (Total Squared Error) is a vector whose components are the total of 
the squares of the estimated velocity errors for the remaining IMUs. The detection 
ratio vector is TSE normalized by the square of the magnitude of the average velocity. 
The isolation ratios form an array with an element for each axis and each IMU. It 
is computed by dividing the square of the estimated velocity error component by 
the corresponding component of TSE. 

"Three Sigma" detection provides a warning and a necessary condition for further 
detection and isolation analysis in this FDI technique. The detection ratio vector 
is compared with the "Three Sigma" detection constants. Without detection at this 
level, the system will proceed with normal navigation. When a "Three Sigma" 
detection occurs, an attempt at isolation is performed. The isolation ratios for 
each of the remaining IMUs corresponding to the axis in which an error is detected 
are compared with the "Three Sigma" isolation threshold. Note that the detection 
process has performed one level of isolation, that is, it has isolated an error to a 
particular axis. Red line detection and isolation tests are performed independently 
of "Three Sigma" isolation. This is important insofar as third failure detection is 
concerned. The red line detection and isolation procedureis the same as the "Three 
Sigma" detection and isolation except that different thresholds are used, and the 
third detection is recognized. 

If a red line error is detected and isolated, the system is reconfigured by removing 
the failed IMU. After reconfiguration the entire FDI is reiterated on the remaining 
IMUs in an attempt to screen additional simultaneous failures prior to proceeding 
with navigation. The navigation routine computes position and velocity updates based 
on the average, delta velocity of the remaining IMUs. The result is compared'with 
the perfect IMU and is printed and plotted as a figure of merit of the FDI scheme. 
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4.3.2 Gyro Drift FDI Verification Program (Unpowered Flight) 

The following description of the gyro drift verification program for cruise flight is 
to be used in conjunction with Figures 4- 8a and 4-8b. The Detection and Isolation 
thresholds and gyro sampling are inputted using data cards. 

The gimbal angles for the perfect and the four operational IMUs are read from 
their respective files. 

A quaternion of rotation is computed for each IMU with these gimbal angles. This 
represents the transformation from a common body (nav base) frame to the stable 
member inertial frame. An average quaternion is derived from the individual 
quaternions of all operational IMUs. The product of these individual quaternions 
with the conjugate of the average quaternion yields an estimate of the error quaternion 
relative to the stable member reference frame. Error angles about each IMU axis 
are extracted from these error quaternions. Every AT seconds an estimate of the 
square of the drift rate is obtained from present and past error angles. The detection 
parameter (TSE, total squared error) is the sum of the squares of the individual 
axis drifts. An isolation ratio is computed from the square of the individual drift 
error normalized by the corresponding component of TSE. 

An error is detected when a component of TSE is greater than a maximum allowable 
drift squared. Isolation occurs when an error has been detected, and whena particular 
instrument axis contributes a significant portion of the total squared error. This 
is controlled by the isolation threshold. This system, mechanized for four IMUs, 
allows isolation of two failures and the detection of a third failure. After each 
isolation the system is reconfigured by removing the failed IMU and by reiteration 
of the FDI logic. The average attitude is compared with the perfect attitude at 
every time step. This figure of merit, along with the detection ratios and error 
angles, is both printed and plotted for evaluation. 

Simulations are shown in the next chapter for the colinear IMU configuration, powered 
and unpowered flight phases. Simulations were also developed for the theory of 
implementation at the two IMU level from equations developed in Chapter 3. The 
simulation development follows the two IMU equation format directly and will not 
be represented in this chapter. 
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Figure 4*8 a Gyroscope FDI in Cruise Flight 
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Figure 4-8b Gyroscope FDI in Cruise Flight 


























5.0 FAILURE DETECTION AND ISOLATION SIMULATION RESULTS 


A digital simulation of the multiple IMU system (Figure 4-5) has been prepared for 
use in evaluating the FDI techniques developed in this study. The full model is 
based upon four independent single KT-70 models. 

In the simulations presented, a series of statistically generated standard la IMU 
error parameters is used to represent a normal system. Other IMU models, which 
include known performance degradation, are then utilized with the standard IMUs 
to form the multiple IMU set for FDI evaluation. The FDI logic is tested by evaluating 
its performance in locating the given degradation. The following sections are 
organized to present the colinear axis simulations for each mission phase in Sections 

5.1 through 5.4. Section 5.5 then presents all the skewed axis simulation results. 

5.1 NOMINAL BOOST VELOCITY FDI TEST RESULTS 

An example of a simulation of this type is shown in Figure 5-1. In addition to 
three normal IMUs, a degraded IMU containing an error in the altitude channel 
accelerometer of 6750 ppm in scale factor is utilized for FDI evaluation. This 
system of four IMUs is evaluated using the powered flight segment of the nominal 
boost trajectory. The bottom picture of Figure 5-1 shows the time profile of the 
altitude channel detection ratio. It is seen that the red-line detection threshold 
established for this mission is violated at 36 seconds into the flight. The top of 
Figure 5-1 shows the altitude velocity error of the degraded IMU as well as the 
average navigation velocity error as a function of mission time. The velocity error 
of the degraded IMU increases until the detection, isolation and automatic 
reconfiguration is accomplished at 36 seconds. The reconfiguration of the system 
can be observed by the change in slope of the navigation error. Note that a 3a IMU 
performance detection and isolation of the degraded IMU occurred at 6 seconds, 
but no reconfiguration was done since mission safety was not in question. 

An example of a dual failure simulation along a single axis for the nominal boost 
mission is shown in Figure 5-2. This system of four IMUs consists of two normal 
and two degraded IMUs at the time of launch. The IMU degradation models are 
both in the altitude axis accelerometers and are specified in the figure. The detection 
and isolation of IMU #1 and reconfiguration occur, as before, at 36 seconds. The 
detection, and isolation of IMU #2 and reconfiguration occur at 225 seconds. Notice 
that with dual simultaneous failures occurring on a single axis, the failure detection 
and isolation implementation was effective. Thisis possible since the velocity error 
propagation characteristics of both failures are significantly different. In general. 
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Figure 5. i 

Nominal Boost Mission Simulation Results. 
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Figure 5.2 

Nominal Boost Mission Simulation Results 
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dual simultaneous failures can be detected and isolated as a pair if their individual 
error propagations do not have similar simultaneous magnitudes. 

In general, dual simultaneous failures not associated with the same axis are 
identifiable with the use of this FDI scheme. Simultaneous failures along the same 
axis can not be individually isolated, however, unless the error propagations are 
significantly different. If appropriate failure detection and isolation constants are 
defined dual simultaneous failures can be detected and isolated as a pair if their 
individual error propagations do not have similar simultaneous magnitudes. 

An example of third failure detection during nominal boost is shown in figures 5-3 
and 5-4. These represent the down range and altitude channels respectively. The 
third error source of 3330//g accelerometer bias has been included in addition to 
those described in figure 5-2. The effect of scale factor error and accelerometer 
bias are felt early in the flight and hence are detected and isolated at 30 seconds 
and 34 seconds after liftoff. Note that the addition of an error source has not 
appreciably affected the detection and isolation times associated with 1MU #1. Figure 
5-4 shows the third detection. It has occurred at 226 seconds which coincides with 
separation at which time the redline threshold velocity is reduced. 

5.2 BOOSTER ENTRY FDI TEST RESULTS 

Figures 5-5 through 5-10 represent the results of one fail, two fails and a third 
detect for the boosterentry trajectory. The first fail case, figure 5-5, is caused 
by a bias of 2.86 cm/sec in the down range accelerometer. The failed IMU is 
isolated after 45 seconds into the flight. The two failure situation is shown in figures 
5-6 and 5-7. Figure 5-6 depicts the isolation of IMU #1 at 75 seconds. The error 
source is a constant 2.15 cm/sec accelerometer bias along the cross range axis. 
The second failure, 5200 ppm scale factor error on the down range accelerometer, 
is shown in figure 5-7. One can see the effect of scale factor error on the navigation 
error as a representation of the thrust profile. Also note that the squared criteria 
detect ratio has magnified this effect in order to insure positive detection. Detection 
and isolation for this case was accomplished at 381 seconds. 

The three failure situation for boosterentry is shown in figures 5-8 to 5-10. Figures 
5-8 and 5-10 are the down range components for IMU #1 and IMU #3 and thus the 
plot of detect ratios are identical. It is seen that IMU #1, with 2.86 cm/sec down 
range accelerometer bias, is isolated after 45 seconds. After 75 seconds the 2.15 
cm /sec A-bias along cross range has been detected and isolated, as seen in figure 
5-9. The third failure, down range accelerometer scale factor error, is detected 
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Figure 5. 7 

BOOSTER ENTRY MISSION SIMULATION RESULTS 



Figure 5. 8 

BOOSTER ENTRY MISSION SIMULATION RESULTS 
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Figure 5.9 

BOOSTER ENTRY MISSION SIMULATION RESULTS 
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Figure 5. 10 

BOOSTER ENTRY MISSION SIMULATION RESULTS 
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DETECT RATIO 



after 381 seconds. Review of figures 5-8 through 5-10 again demonstrates that 
detection and isolation times are independent of the number of error sources. 

5.3 ORBITER ENTRY VELOCITY FDI TEST RESULTS 

The two levels of error isolation and third detect for the orbiter entry trajectory 
are demonstrated in figures 5-11 through 5-15. The redline threshold for this 
trajectory is unique in that it is represented by an exponential in time, rather than 
a piecewise constant. A first failure of .75 deg/hour (50 meru) bias drift on the 
z - gyro is shown in figure 5-11. Detection and isolation time is 5502 seconds into 
the flight or 1088 seconds after FDI initialization. The FDI is started at 4414 seconds 
into the flight for all orbiter entry simulations. 

The two failure case (figures 5-12 and 5-13) is the same as the first case, with the 
addition on a 5m radian inflight alignment error for all axes of IMU #2. It can be 
seen from figure 5-12 that 12 more seconds (t=5514) are required to isolate the .75 
deg/hr biasdriftin IMU #1. The inflight alignment error is isolated at 5902 seconds 
into the flight or 1488 seconds from FDI initialization. This is shown in figure 
5-13. 

The third detect is demonstrated by augmenting the system with an IMU containing 
an accelerometer whose bias is 2400>ug. Figure 5-14 shows the first fail (ac- 
celerometer bias) at 4430 seconds and third detect at 4831 seconds. The second 
failure (inflight alignment error) is detected and isolated at 468 2 seconds seen in 
figure 5-15. 

Notice that the orbiter cases have not shown the perfect consistency in detection 
and isolation times that were evident in the nominal boost and booster abort 
trajectories, and that they are by far the most sensitive test of the FDI implementation. 

5.4 ORBITAL FLIGHT GYROSCOPE FDI TEST RESULTS 

Figures 5-16 through 5-21 summarize the simulation results for the gyroscope drift 
failure detection and isolation. 

The trajectory for these simulations is a 100 nm equatorial orbit. The x-axis of 
the IMU is out of plane, directed north. There is a constant vehicle rate about the 
x-axis equal to the orbital rate (i.e. the vehicle is in a local vertical mode). The 
failure drift threshold is set at .75deg/hours (50 meru). This value represents the 
reentry requirement of gyroscope bias uncertainty. All drift errors put in the 
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ORBITER ENTRY MISSION SIMULATION RESULTS 
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ORBITER ENTRY MISSION SIMULATION RESULTS 
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UNPOWERED FLIGHT SIMULATION RESULTS 
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simulations are 10% above this required threshold. The gimbal angle quantization 
level is assumed to be 40 arcseconds, and the AT used in estimating angular rate 
is set at 120 seconds. That is, all detection and isolation variables are computed 
every 120 seconds and remain constant over the succeeding 120 seconds. Thus the 
total squared error (TSE) in all the graphs appears as quantized steps. 

The first failure case is represented in figure 5-16. As mentioned previously, the 
input drift is .825deg/hour (55 meru) on the x-axis. A single time step was required 
to detect and isolate this failure. 

Figures 5-17 and 5-18 show the results of two failures. These failures are 55 
meru on the x-axis of IMU #1 and 55 meru on the y-axis of 1MU #2. Both failures 
are detected and isolated in one time step. 

The third detection capability is shown in figures 5-19 to 5-21. The third error is 
55 meru on the z-axis of IMU #3. The first failure (fig. 5-19) is detected and 
isolated in one time step. It can be seen from figure 5-20 that the detection threshold 
is satisfied in one time step for the second failure, but two steps are required to 
provide isolation. The third failure is detected (fig. 5-21) after 3 time steps. It 
should be noted all cruise flight simulations were also exercised at drift levels 
slightly below the .75°/hr critical threshold and no detection or isolation was found. 

5.5 TWO IMU FDI SIMULATION RESULTS 

The simulation results in the next four parts demonstrate FDI capability when only 
two IMUs are remaining and detection and isolation are at the instrument level. In 
these four cases, one of the IMUs has been skewed by 60 degrees about an axis 
which is diagonal to the instrument triad axes. 

The first three cases represent powered flight FDI in nominal boost, booster abort 
and orbiter entry. Each case demonstrates one of the three possible powered flight 
detection criteria (i.e. velocity magnitude error, platform angular error, and platform 
drift error). 

The final case represents unpowered flight, drift error detection and isolation. 

5.5.1 Nominal Boost 


The nominal boost simulation is an extension of the test shown in figures 5-3 
and 5-4. The error sources are 6750 ppm SFE in the altitude accelerometer 


76 



of IMU#1, 3330^/g bias in the down range accelerometer of IMU#2, and 5 mrad 
accelerometer misalignment in IMU#3. In addition to these errors, an analog 
torquing scale factor of -1000 ppm was assumed to be introduced while slewing 
the IMU to its skewed orientation. Figures 5-22 and 5-23 show the altitude 
navigation velocity error and the detect ratio. Slewing starts after the second 
failure is isolated at time=34 seconds as shown in figure 5-3 and is completed 
at 104 seconds. Detection and isolation is accomplished at t=226 when the 
red line threshold is reduced. The effect of reconfiguration is displayed in 
the navigation velocity error. 

This same simulation was performed with an assumed +1000 ppm analog 
torquing scale factor error . This torquing error reinforces the accelerometer 
misalignment so that third failure detection and isolation is accomplished 
earlier (t=192 seconds). 

5.5.2 Booster Entry 

The boosterentry simulation is a continuation of the three failure simulation 

2 

shown in figures 5-9 and 5-10. The error sources are 2.86cm/sec down 

2 

range accelerometer bias in IMU#1, 2.15cm/sec cross range accelerometer 
bias in IMU#2, and 5200 ppm down range accelerometer scale factor error 
in IMU#3. The analog torquing scale factor error is again set at +1000 ppm. 

£ 

Figures 5-24 and 5-25 show the down range navigation velocity error and the 
velocity magnitude detect ratio. Slewing starts after isolation of the second 
failure (t= 60 seconds) and is completed at t= 1 30 seconds. The third failure 
is isolated to IMU#3 at t=363 seconds. Removal of IMU#3 can be seen in the 
navigation velocity error. 

5.5.3 Orbiter Entry 

The orbiter entry simulation extends the results shown in figures 5-14 and 
5-15. The error sources are 2400//g accelerometer bias on the y-axis of 
IMU#1, 5mrad inflight alignment error oh all axes in IMU# 2, and ,75degree/hour 
NBD in the z-axis gyro of IMU#3. 

Figures 5-26a,b,c show the navigation error of the average IMU velocity with 
respect to the perfect IMU velocity for all three axes and figure 5-27 is the 
two IMU attitude drift detect ratio. After IMU#1 and IMU#2 have been removed 
from the system, the major sources of error are the ,75°/hr NBD on the 
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TWO IMU FDI SIMULATION RESULTS 




z-axisof IMU#3 and the assumed 1000 ppm analog torquing scale factor error . 
Slewing was initiated after the second failure was isolated at t=4682 sec. 
The bias drift error is detected and isolated at 5602 seconds. It can be seen 
that the drift error has the least effect on the Z velocity. The effect of the 
analog torquing scale factor error can be seen in all velocity error profiles 
at 4600 seconds. This effect is not negligible. 

5.5.4 Unpowered Flight 

The unpowered flight demonstration of two IMU FDI is mechanized by simulating 
two IMUs in a skewed configuration. IMU#1 is a simulated la instrument. 
IMU#2 contains a 55 meru bias drift on the y-axis. The FDI algorithum estimates 
drift by differencing angular error estimates at two times, 300 seconds apart. 
Ascan be seen from figures 5-28 and 5-29 only one sample period is required 
to correctly detect and isolate the failed IMU. 
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6.0 SYSTEM CHECKOUT PHILOSOPHY AND PRELAUNCH VERIFICATION 

Multiple IMU inertial system checkout methods differ markedly from those of 
conventional, single IMU systems. They enjoy a significant advantage in that internally 
redundant data can be used for self checking to reasonability limits. Further, in 
implementations which do not include external optical data for absolute external 
alignment, the component IMUs can be initialized independently and verified with 
respect to each other. 

In view of the unique characteristics of a multiple system, an appropriate checkout 
philosophy and technique must be developed. The goals of the checkout remain 
identical with those of earlier inertial systems: completeness and precision with a 
minimum test time. To these must be added the requirement that the test sequences 
be completely on-board and self-contained. Presumably, the inherent features of 
the multiple system would be exploited during checkout. The discussion which follows 
assumes a baseline system consisting of four four-gimbaled IMUs with parallel 
triads mounted on a single navigation base. This discussion also applies directly 
to the three IMU implementation. An onboard computer monitors and controls all 
IMUs. It will be assumed that no optical alignment aids are available, either as a 
sextant mounted on the navigation base or an optical path to mirrors mounted on 
the stable members. 

This chapter comprises a brief discussion of the checkout philosophy proposed and 
describes two possible verification tests. A multiple position test enabling solution 
for accelerometer error parameters and a reasonability comparison of gyro drift 
measurements with reasonability estimates drawn from previous calibration loads 
is recommended for implementation. 

6.1 CHECKOUT PHILOSOPHY 

Interest here is directed toward a system verification test to be performed during 
the countdown prior to launch. It should be emphasized that shuttle vehicle operational 
requirements demand a countdown which is short compared to the multiple day Apollo 
checkout. In turn, this necessitates shorter individual tests, and, further, that 
individual subsystem tests become almost entirely autonomous. 

In short, the shuttle vehicle requirements envisioned dictate a prelaunch test and 
alignment program employing no external or carry-on GSE, no optics, and, if possible, 
no human interpretation or intervention. One additional goal is to_ perform the 
prelaunch verification and alignment sequence in less than four hours. 
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The foregoing requirements will dictate the form of the prelaunch checkout. Its 
underlying philosophy, however, follows from the goal of the test. This goal, simply 
stated, is to determine that the projected performance and reliability of this system 
is sufficient to allow committing the vehicle to the mission. 

It must be assumed, at this point, that a considerable body of knowledge about the 
characteristics of the flight hardware is available. Given this information, tests of 
reliability can be devised. The Apollo IMU provides a clear example of testing 
techniques devised from comprehensive knowledge of the flight hardware. The 
acceleration sensitive drift term due to specific force along the gyro's IA was normally 
stable to within. 0.075°/hr/g (5 meru/g). A shift of 0.375°/hr/g (25 meru) proved 
to be a reliable indication of impending wheel bearing failure. ^ Experience proved 
that a gyro exceeding the "Delta 25 criterion" would operate with acceptable 
performance for at least an additional 200 wheel hours, long enough to carry the 
IMU through an Apollo flight even if the shift was found during prelaunch checkout. 
It is only from experience with a given instrument in a system that such criteria 
may be devised. , 

The prelaunch checkout test will not serve as a system calibration procedure. It 
will seek only to compare present performance (as defined by lumped error 
parameters) with previous calibration history, and to answer the following questions. 

Are measured shifts within acceptable limits? Is the present reliability projected 
for the system sufficient for the mission? In summary, are any soft failures present? 
The- test must also answer the more mechanical question: have any hard failures 

occured either intermittently or continuously? 

Since no external references are provided, the only judgements which may be made 
compare the output of one instrument or IMU with another, or with an average of 
all the IMUs. In practical terms, this means that four values of drift about a gimbal 
axis will be measured, each of which can be compared with the rest. No absolute 
gyro drift term is extracted from these data. 

The philosophy of the prelaunch checkout test may then be summarized. An 
autonomous test is to be defined which will estimate lump drift parameters and 
measure relative drifts. These errors will be compared with the system's calibration 
history, on one hand, and with predetermined thresholds, on the other. The end 
results of the test will be a projection of system reliability with a consequential 
go /no go decision. Possible remedial actions will be re-compensation and a full 
retest, or a call for external judgements. 
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6.2 VERIFICATION TESTS 


The purpose of the verification test is to project inertial system reliability, and 
determine whether it meets mission requirements. This decision can be based 
only on measurements of system performance as close to actual flight as possible. 

Two broad classes of verification test can be described. One seeks to measure 
inertial component parameters, and use them for comparison with established limits. 
These tests resemble the classical procedures closely, and need not utilize redundant 
properties of the system. A second class of tests measures IMU output and compares 
it with output of other IMU s. Comparison might be made, for instance, through use 
of the multiple IMU FDI. These tests rely on the redundant quality of available 
data. 

6.2.1 Testing Against Limits 

The limits against which current performance are checked can be a combination of 
the mission red lines (derived in Chapter 4), or current single IMU performance 
can be judged directly against the other IMUs in the multiple system. 


Mission red lines have been treated extensively in Chapters 4 and 5. The red lines 
for each mission phase (tables 3.1 to 3.3) may be distilled down to the following 
limits (table 6.1), merely by taking the most stringent requirement on each term. 
Notice that all thresholds used must be redetermined considering the single gravity 
prelaunch environment. Limits on some axes are not, in the previous chapters, as 
stringent as on others. However, testing all axes to the most demanding requirement 
is sufficient and is simpler than testing against a large set of individually established 
thresholds. (Red lines of parameters not included in table 6-1 exceed estimated / 
30<r performance.) 


Table 6.1 Established Mission Red Line Performance 


Term 


Uncompensated Errors 


Accelerometer Bias 
Accelerometer Scale Factor Error 
Gyro Non- G- Sensitive Drift 
Cross Range Gyro Spin Axis 
G-Sensitive Drift 


±1.77 cm/s 2 
+ 2010 to -6750 ppm 
-0.10°/hr (7 meru) 

2.25°/hr/g (150 meru/g) 
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The foregoing values must be compared critically with attainable system performance 
and must also be updated when additional mission phases or vehicle models are 
implemented. Kearfott has tabulated expected performance of its instruments (see 
Appendix A). Parameters directly comparable with those in Table 6.1 are: 


Table 6.2. Estimated System Performance Uncertainties 


Term 


Kearfott 3a Estimate 


o 

Accelerometer Bias ±0.30 cm/s 

Accelerometer Scale Factor Error! 900 ppm 
Gyro Non-G-Sensitive Drift ± 0.03°/hr (2 meru) 

Gyro Spin Axis G-Sensitive Drift ± 0.15° /hr (10 meru) 

Clearly, system performance meeting the uncertainties of Table 6.2 will easily meet 
the red line values. That is, nominal system performance is significantly better 
than mission requirements. Hence, it is suggested that a test to 3 a parameters is 
sufficient for checkout purposes. These limits give added confidence that all systems 
are operating in their normally expected performance range. Mission red lines 
will presently be discarded for the prelaunch verification. 


The remaining suggested limit is a comparison of each IMU's output against a similar 
value predicted using the measurements of all others, its own expected measurement. 
For this comparison, an estimate of performance is drawn for each group of IMUs. 
Comparison of the excluded IMU with the group is then made. It must be understood 
that the values derived represent only short term variations of actual measurements, 
and should not be associated directly with IMU performance as represented by a 
data history. Thus, consider four measurements, W^, i=l, 2, 3, 4 along or about 
each axis. Permit to be either specific force (along X, Y, Z) or a gimbal axis 



<W> = 
] 


•I /W., 
1 * 3 ( i) 


( 6 - 1 ) 


then 


AW.. = |<W.> - W.l , i * j 
U I I M 

’■[i.ij'Vf 

f. . = 3a. - AW. ., i 1 j 
U J U 


( 6 - 2 ) 
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notice that, if any f ^ is negative, a violation has occurred. A review of solutions 
for all four IMUs will serve to identify a failed system along with an indication of 
the quality of all systems. 

In prelaunch tests where instrument parameters can be isolated, comparison with 
prescribed limits will yield a decision. For those procedures where specific terms 
cannot be accessed, comparison with other IMUs must be used. 

6,2.2 Testing By Performance Comparison 

In multiple IMU systems, the redundant information may be utilized in evaluating 
performance of individual IMUs. Procedures which do not yield estimates of error 
parameters can, therefore, be employed. 

It is suggested that the powered flight FDI is an effective tool for screening IMUs. 
W ith the system in a single gravity field, variations in measured AV can only be 
due to instrument errors. The FDI logic, by its nature, should not be effected by 
vehicle sway (as all IMUs will yield the same error specific force due to sway). 
The implementation of FDI derived in Chapter 3 is designed to be mission and time 
independent. In conjunction with thresholds chosen to reflect prelaunch test 
procedures and desired resolution, faulty IMUs can be isolated without requiring 
solution for individual terms. More details concerning use of this mechanization 
will be shown in the next section. 

6.3 TWO PROPOSED CHECKOUT PROCEDURES 

Two significantly different prelaunch checkout procedures will now be developed. 
The first is a fairly conventional six-position test, with the IMU sequenced so that 
data is accumulated with each of the stable member axes up and down. The second 
method aligns all of the IMUs. Then, they are released (inertial mode), subject to 
the earth's rotation and gravity. The powered flight FDI is then used to screen 
accelerometer and gyro failures. With this test employed in three positions, all 
significant g- sensitive drifts can be examined. 

6.3.1 Required Assumptions 

Several assumptions are made. Of primary importance, a model of the system 
will be available such that there is a reference value with which to compare each 
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IMUs output. Typically, this model includes equations for gyros and accelerometers 
such as; 


W = W. + W, . + W 

out in bias g sensitive biases +. 


out 


= (a in + a bias + "'- ) (1 + *W K S 


In these equations, the terms are taken to be physically measurable drifts which 
can be compensated in the onboard computer. The model is limited to those terms 
assessable by the verification test chosen. A full model of the KT-70 IMU, and a 
multiple system made up of KT-70 IMUs, appears in Appendix A. 


A second assumption is that an accurate calibration of all modelled parameters is 
available so that loaded compensation values are nearly correct. In effect, then, 
this checkout is designed to demonstrate that system performance (as it may be 
compared against a model) is not sufficiently degraded to jeopardize mission success. 

Finally, a full set of parameter variances is assumed to be given, representing 
KT-70 performance limits. Error parameter values determined by the onboard 
computer's checkout program are compared with these values, and appropriate 
operational or non-operational decisions are made along with possible problem 
diagnosis. 


6.3.2 Six Position Verification Test 

) 

The classical form of the prelaunch checkout of gimbal systems by calibration is a 
multiple position test. Measurements of gravity and platform drift in each position 
are used to calculate instrument parameters. The derived parameter values may 
then be compared with loaded error terms for the go/no-go decision. 

It is proposed that the instrument parameters found in such a test naturally invite 
comparison with pre-established limits in order to determine the system's 
flightworthine s s . 

The proposed multiple IMU implementation includes full flight computer control of 
stable member positioning, allowing autonomous, multiple position testing. Interest 
is centered on a six position test in which each stable member axis is initially 
positioned up and down. In each position, the platform is then released with earth 
rate compensation. Accelerometer data is taken for two minutes, permitting nearly 
exact solution (hence, excellent compensation) for scale factor and bias error of 
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each accelerometer sensitive axis. Gimbal angles are read at time zero, arid again 
approximately at thirty minutes, in three of the positions.* Then, gimbal resolved 
measurements of gyro drifts . plus earth rate components may be compared among 
the four initially aligned IMUs. (It will be noted that even with an error drift of 
twenty percent of earth rate about one gyro axis, the resulting gimbal angle difference 
at the test's end will be a "small angle". Therefore, direct comparison without 
concern for commutativity errors will be possible.) 

Including the time required to slew and level the platform for each position, this 
test will consume three hours. Initial alignment for launch would still be required. 
The full test, then, could be completed and allow initial alignment within four hours 
of initiation. 

The resolution afforded by this test is assessed as follows: the data collected in 
each position must pass a reasonability test. All measured magnitudes of the g 
vector must agree within a value derived from a specified tolerance on each axis. 
(It is noted that the magnitude is independent of gyro errors.) The accelerometer 
SF and bias values are derived from input axis up and down counts. The dominant 
uncertainty is inexact knowledge of gravity due to instrument misalignment, platform 
drift over the test interval and leveling errors. 

Steady state leveling errors (<f>) are a function of bias and alignment uncertainties 
of the horizontal accelerometers and to some extent drift uncertainties of the 
horizontal gyros. The sense of <f> will change between the up and down positions for 
each axis. 

Platform drift, due to uncompensated gyro drifts, will yield an average offset over 
the measurement time of: 

P=lwt 

The polarity of the offset remains the same in both up and down positions. Further, 


* Gyro drift measurements require large time intervals for sufficient resolution 
depending upon available A/D resolution and signal/noise resolution of gimbal 
information. Therefore, the proposed test limits drift measurements to the three 
positions which excite the g-sensitive drifts most significant to the mission: X-up, 
Y-up or down, Z-up. 

Positions are found by leveling the two "horizontal accelerometers". 
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the overall mechanical misalignment, will also retain its sense. Therefore, these 
two errors may be lumped together by: 


6 = 0 + p 


W ith these definitions, the up and down measurements of the jth accelerometer may 
be written: 


A out Up = [g(cos^cos0 - sin^sine) + Ag^J /Kg(l + Kgg.) 
A ou t^ n = j^g(cos0cos0 + sin^sine) + Ap^j /Kg (1 + F SE^ 


(6-4) 


Ag. is the unknown bias of the jth accelerometer, and Kgg^ its unknown scale 
factor error. K„ is the nominal accelerometer scale factor. 


These two equations (6-4) may then be solved to obtain: 


where 
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and 


Ks^out^ + Aoutf 11 ) -2gsin^sin0 

1 — t- 1 


(6 -6 a) 
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It can be seen (equations (6-5b and 6-5c)) that the solution for scale factor error 


is 


nearly insensitive to misalignments. For small angles, with A^ p ^ 
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This shows a leveling error of 1 milliradian, equivalent to 1 cm/s 6 of non- 

compensatable bias in a horizontal accelerometer, will introduce a 1 ppm error in 

the calculated K . With the same small angle assumptions, equations 6-6a and 
SE-: 

6 -6b yield J 


&A 


AA 


Bj 


Bj 6<f> 


A0 = -g0^ 


Thus, the bias sensitivity to a leveling error of 1 milliradian together with a platform 
drift of 0. l°/hr (7 meru) over the two minute measurement time will introduce an 
2 

error of 0.001 cm/s in the bias determination. 


Theoretical resolution of the gyro test is given by the incremental angle uncertainty 
divided by the measurement interval. The worst case present system angle 
uncertainty is the sum of the gimbal angle uncertainty (2 min) and A/D quantization 
(1.3 min). Thus, the lu resolution becomes: 


W 


res 


uncertainty 
time interval 


3. 3 min _ _ . Inin 
33 min ' min 


0. l°/hr. (7 meru) 


The resolution is seen to be inversely proportional to test time. The one sigma 
resolution cited above is comparable to expected system performance, and is within 
mission tolerances. 


If the A/D conversion is found to have good signal/noise characteristics, the 
measurement of platform drift can be mechanized to eliminate A/D quantization. 
Separate counts are made of elapsed angle (in bits) and time (in system clock pulses). 
The time count initiated with the first pulse following the zeroeth bit (which is not 
counted). The time count ends simultaneously with the last bit. Then the resolution 
is given directly by the linearity of the A/D converter. > 


Resolution of lump drift parameters is seen to be sufficient in this test. However, 
it must be borne in' mind that no external reference value is available for this 
parameter. Only relative drift of the IMUs can be compared. For this comparison, 
the logic shown in equations 6-1 to 6-3 is employed. A 3cr estimate of each IMU’s 
drift is formed using the measured drift of the other platforms. Then, the measured 
drift of each is compared with its estimate. 


With sufficient resolution believed available, gyroscopes meeting the criterion shown 
in equation 6.3 are considered flightworthy. 
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A summary of the six position test procedure outlined would be that the resolution 
available is sufficient to show that each IMU meets mission requirements at launch. 
Within stated uncertainties, accelerometer bias and SFE parameters may be 
compensated exactly. Gyro lump parameters can be resolved to within expected 
system performance levels. The time required for this test procedure is presently 
estimated to be 2.5 hours. This is a conservative estimate and depends directly on 
system characteristics. Including initial alignment, the full prelaunch sequence 
will consume less than four hours. 

A flowchart of the six position test appears as figure 6-1. It should be understood 
that all operations must be carried out for each on line IMU. 

6.3.3 Verification Test Using Powered Flight FDI 

The second class of tests described above compares the outputs of the IMUs in 
order to establish expected reliability on the basis of relative performance. A 
three position test which makes this comparison by using the powered flight FDI 
developed in Chapter 3 is described here. 

Each IMU has been calibrated in the recent past. Error parameters reflecting this 
calibration are loaded. All platforms are aligned initially, and are released (either 
in the inertial mode or earth rate compensated) at t=0. Monitoring of accelerometers 
and gyroscopes is accomplished by examination of velocity error ratios (equation 
3-6). This test is performed in three positions, chosen to excite all g-sensitive 
gyro biases. Positions are determined by leveling the two horizontal accelerometer 
input axes. 

As a first step, the magnitude of the gravity vector measurement of each IMU is 
compared with the known value. Any IMU whose measurement does not agree within 
acceptable limits is flagged as having an accelerometer failure. 

It is obvious that bias and scale factor errors are not separable. The output of 
each measurement axis (scaled in pulses/sec) is given by 


A 


(-gj + A Bii ) 
out ij = K g (1+ K se ! ) 


( 6 - 10 ) 


where i (the IMU number) = 1, 2, 3, 4; j = X, Y, Z. A B is the bias. Kg the nominal 

scale factor, and K the scale factor error. With each axis up only, and using 
SE 

each for leveling in the other two positions, separation is impossible. 
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Figure 6-la 

Flow Chart of the Six Position Verification Test 


Figure 6-lb 
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Figure 6-lc 


Flow Chart of the Six Position Verification Test 



Figure 6-ld 















However, in this proposed test redundant measurements of gravity and earth rate 
are available. These are incorporated into the powered flight FDI. A first cut at 
detection, for the prelaunch verification test, examines the time history of the velocity 
error ratio (Equation 3-6). 


V 


- Ve ii 


Ave 


er ij " jY 


where i = IMU 1, 2, 3 or 4, j = X-, Y, Z. V is the average inertial velocity 
calculated from the outputs of all the online IMUs. Given that the only system 
errors are miscompensated accelerometer biases, then it is easily established that 


v erjjOC Aby (6-11) 

and is time independent. Clearly, then, detection and isolation depend simply on 
magnitude of the term and the thresholds used. Similarly, if only miscompensated 

SFE parameters are postulated, a time independent ratio 

Ver ij ^[i +1 ^3E..] (612) 

is found. Again, detection and isolation are dependent on the relationship between 
error and the thresholds chosen. Examination of Equations (6-11) and (6-12) shows 
that bias and scale factor errors may be separable, but only if is constant 

and the test conditions are well known. In general, they remain inseparable. 


Gyro drifts, on the other hand, will result in time varying velocity error ratios. If 
the history of these ratios shows variation, analysis procedes through the FDI logic 
presented in Chapter 3, equations 3-4 through 3-15. 

Consider an IMU with a drift rate of w about a horizontal axis, compared with perfect 
IMUs. Then (for wAt a small angle). 


V OwAt (6-13) 

er 

In theory, detection and isolation is seen to vary with the parameter error, thresholds 
chosen and time. Given sufficient time, a constant error will be found. The problem 
remaining is to study the trade-off between resolution required and time available, 
and choose thresholds in line with the results. 
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The character of the velocity error ratio has been suggested for three parameters. 
As shown in the next chapter, describing simulation results, observation of these 
characteristics is an effective diagnostic tool. 

The proposed test may be summarized, then, as follows: Using powered flight FDI 
logic with thresholds chosen for prelaunch verification, gyro errors above required 
resolution can be detected and isolated. Accelerometer errors can be detected 
similarly with the addition of a check on the time history of the velocity error 
ratio: a constant, non- zero ratio implies an error which can be detected by comparing 
Vjrpy with an additional threshold. A flowchart for this test procedure is shown in 
Figure 6-2. 

6.4 Conclusions 

The overall conclusion drawn from this work is that each of the two suggested tests 
is employable for the prelaunch checkout of a multiple IMU system. Each has sufficient 
resolution. A final choice cannot be made without detailed tradeoff studies of the 
candidate system and the desired resolution vs. available time and computer 
requirements. Evaluation of simulations of the two suggested tests is presented in 
the next chapter. The multiple position test is considered the best candidate. 
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Figure 6- 2c 



Figure 6 -2d 


Flow Chart of Multiple IMU 


Verification Test Using Redundant Data 


and Powered Flight FDI 















7.0 MULTIPLE IMU SYSTEM MODEL AND SIMULATIONS OF PRELAUNCH 
CHECKOUT PROCEDURES 

A digital model of the multiple IMU system has been coded, intended primarily for 
simulation and evaluation of the proposed prelaunch verification procedures. The 
model closely follows the single IMU model description which appears in Appendix 
A. Two versions of the prelaunch test were simulated. The results of these 
simulations are presented and discussed. 

7.1 SINGLE IMU MODEL 


A description of the KT-70 IMU appears as Appendix A of this report. Working 
from this description, a digital model of this IMU has been assembled. An extension 
of this work led logically to coding a model of the multiple IMU system. 


The model of the single IMU centers on equations describing the output of the gyro 
and accelerometer "triads". Defining; 


*JK 

G ^IIS 

C GSD " 

— IEL 

% = 
BD = 


The instantaneous laboratory to stable platform transformation. 

The stable member reference triad to gyro input axes transformation. 
A matrix including all g-sensitive uncertainty terms. 

The earth rate vectors in laboratory coordinates. 

The gravity vector in laboratory coordinates. 

Non-g-sensitive uncertainty drift. 


Then, with BD and representing the noncompensatible uncertainties of the 

drift (drift errors). 


W = G C W + 
OUT ^MIS JK ICL 


— + C GSD G MIS C JK G L 


(7. 1) 


In a gimbaled system, these -rates will be counteracted by counter rotation of the 

Jjc 

gimbals. Taking C RESV to be the instantaneous representation of the resolver chain, 
then the gimbal angles will change according to: 

G ANG = ~ C RESV W OUT (7-2) 

Clearly, and are functions of CL^q. and will vary with time. 
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Accelerometers are modeled using the following definitions: 


^MIS 


The instantaneous laboratory to stable platform transformation. 

The stable platform reference frame to accelerometer input axes transformation. 


AB = A vector of accelerometer bias uncertainties. 

* 

Acpjc Represents the measurement and cross coupling errors 
in the accelerometers, given by 


CRC 


1 

A 

CXY 

A 

cxz 

A 

CYX 

1 

a cyz 

A czx 

A 

CZY 

1 


AgpM Represents scale factor error, given by 
1 


A* = -L 
a sfm sf 


1+K 


SEX 

0 

0 


0 

1 


1+K, 


SEY 

0 


1+K SEZ 


Then the output of the accelerometers, without CAPRI quantization, is (in units of 
AV pulses): 


AV(At) - A gFM (AB - A crc A mis C jk G L ) A 1 t 


(7.3) 


Modeling of readout chain errors follows the model presented in the Appendix. 
Similarly, intergimbal nonorthogonalities are included in the transformation Cj R . 


This model is now programmed for evaluation using the digital computer. 


7.2 MULTIPLE IMU MODEL 

A digital model of a multiple IMU system has been coded. Simulation of the hardware 
is made simply by extending the dimensions of the equations 7.1 to 7.3 to include 
twelve functional axes (four IMUs). This model is illustrated by flow chart in Appendix 
B. The salient feature of the model is the representation of the gimbal angles by a 
differential equation driven by resolved gyro drift. 

Both of the prelaunch verification tests described in the previous chapter are included 
in the programs which make up the simulation. Each has been exercised in simulations 
designed to determine whether theoretical resolution can be achieved. 
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7.3 SIMULATION RESULTS 


Use has been made of the digital simulation of the multiple IMU system in a prelaunch 
environment in evaluating the two proposed verification tests. The first of these 
tests, in summary, is a six position test yielding exact accelerometer parameters 
and gimbal rate estimates for comparison among IMUs. The second test initially 
aligns all platforms and then monitors all instruments using powered flight FDI. 
This test is performed in three orientations so that all significant gyro g- sensitive 
drifts are excited. In each case, a stable base was assumed. 

7.3.1 Six Position Test 

Examination of simulation results indicates that uncertainties in accelerometer 
parameters agree well with theoretical results. In runs for which the only errors 
assumed were accelerometer bias or scale factor errors, the solution was exact. 
Bias uncertainties were found to be linearly dependent upon misalignment and 
platform drift. 

Resolution of gyro lump parameters, using this model of the KT-70 with gimbal 
nonorthogonalities, a full gimbal chain error model, but without noise in the A/D 
conversion, appeared to be limited to 0.22°/hr (15 meru) in the 30 minute /position 
testing period. The resolution is well within the mission redlines. 

In these simulations, gyro drifts were calculated from gimbal rates. Each lump 
drift derived was also measured against the standard deviation of like axis drifts 
on other platforms. This method of comparison, excluding the term to be compared 
from the standard, was chosen to avoid degradation of all instrument uncertainty 
estimates by a single bad unit. It was verified that drifts on the order of three 
times the standard deviation of the three comparable terms could be isolated with 
high certainty. This indicates that the redundant quality of the data in a multiplicative 
system can be used in system checkout. 

7.3.2 Three Position Test Using FDI As Monitor 

Extensive simulations with both deterministic and random errors used in the 
instrument models have verified the predictions that velocity error ratios are 
proportional to accelerometer bias errors and inversely proportional to one plus 
the scale factor error. Resolution of gyro errors, as anticipated, is time dependent. 
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Figure 7.1 shows that the prelaunch checkout procedure simulation yields linear 

in time for various drift rates. Similar data has been found in simulations with 
combinations of drift terms about any two accelerometer axes simultaneously 
observing proper polarity. The simulations have also demonstrated that is 

linear with accelerometer bias and scale factor error. 


Although a more complex decision algorithm will be required, it is believed that a 
three position test monitoring system performance through use of powered flight 
FDI will be a sufficient prelaunch checkout. The decision algorithm will have to 
consider time dependence and magnitude of the v ER^j term along each axis in each 
position, thirty six terms in all. 


7.4 SUMMARY 

To the extent that a simulation can be trusted in modeling a real system the two 
suggested prelaunch checkout tests have been shown to serve as predicted. The 
six position test method appears to have advantages over FDI monitoring, and is 
therefore recommended for two reasons. One, the former test determines ac- 
celerometer errors with good resolution while FDI monitoring yields numerical 
values only with difficulty. Two, a highly complex decision algorithm will be required 
for the FDI test implementation. 
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Figure 7. 1 - V ER of East Axis for Drift About North Axis 
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8.0 LABORATORY TEST PLAN 

8.1 INTRODUCTION 

It should be recognized that the test plan to follow directly addresses the laboratory 
testing of three production KT-70 IMUs and their supporting electronics. This test 
plan will identify laboratory testing requirements which are of prime importance 
to be able to qualify an air navigation type ISS for the shuttle mission. The standard 
IMU configuration is known to contain marginal areas of performance with respect 
to the shuttle mission. The testing will be designed to include evaluation of these 
areas, unless prior work eliminates this need. This will include the IMU shock 
mounts, the gimbal chain calibration stability, temperature gradient effects due to 
stable member temperature control, attitude control during gimbal flip, as well as 
the multiple IMU system grounding problems. Many of these areas require evaluation 
to develop testing techniques as well as to determine available performance. One 
example of special interest is the development of a testing technique for gimbal 
chain calibration as well as determining if the calibration stability of the gimbal 
chain after resolver updating (expected total calibration stability is around one arc 
minute) is\adequate for the shuttle. 

8.2 TEST PLAN PHASES 
8.2.1 IMU Calibration 

IMU parameter sensitivity to various shuttle flight trajectories have been previously 
identified in this study. This section is concerned with the baseline calibration of 
the parameters of the Inertial subsystem prior to the prelaunch testing phase. The 
laboratory test plan will include an instrument calibration test patterned directly 
from the present Kearfott multiple position IMU calibration set implemented in the 
A7 D/E program. This test will verify short and long term stability of the IMU 
instrument set and provide information to insure the adequacy of the instrument 
model which forms the basis of the IMU calibration parameters. Based upon the 
history of the individual instrument parameters, special test sequences can be 
established to confirm the instrument models used in the present calibration plan. 

Two other areas will be studied in the test plan. Both areas must be investigated 
carefully if "off the shelf" IMU technology is to be applied to the space shuttle. 

The first study area concerns the attitude chain calibration. The existing four gimbal 
attitude chain contains single speed synchro readouts on three of the four gimbal 
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axis. The present accuracy is not sufficient to do the normal in-flight alignment 
During alignment, the IMU is commanded via the computer to attain a known stable 
member inertial frame (derived from the common navigation base optics system) 
as a reference frame to perform the entry mission phase. Various accuracy 
predictions have been made of the ability to calibrate these synchro chains including 
A/D electronics, and to determine the gimbal orthogonality, gimbal zero reference 
stability and the fourth gimbal offset characteristics. The total gimbal chain 
calibration tolerance, as observed by the expected accuracy of the three Euler angles 
orienting the body with respect to the stable member reference frame, is expected 
to be about two milliradians about each axis after calibration. This uncertainty (if 
it is true) still represents a large error source in the normal entry trajectory 
phase. It is believed that overall gimbal calibration stability can be greatly improved 
by replacing the synchros with multispeed resolvers. This retrofit should be 
implemented and evaluated. The ability to calibrate an operational system is dependent 
upon the basic angle readout stability over 360 degrees, and bias (offset) sensitivity 
to air coolant temperature changes. The air coolant system temperature variation 
and active stable member temperature controller set up a conductive temperature 
gradient in the KT-70 system in which the angular encoders are mounted. The 
actual temperature sensitivity of the gimbal calibration should be established by 
the planned testing. Another shuttle gimbal chain calibration uncertainty results 
from the unknown stability of the laboratory gimbal calibration of the IMIT across 
the boost flight environment. The present failure detection implementation in powered 
boost flight is not directly dependent on the gimbal chain but uses the stable member 
incremental velocity output for detection and isolation of accelerometer and gyroscope 
malfunctions in this flight phase. It is essential, however, that the established IMU 
calibration survive the boost profile within known small residual offsets to accomplish 
a calibrated in-orbit IMU alignment prior to entry. Of special interest in this testing 
phase is the evaluation of the IMU shock isolation mounts. The maximum offset 
with known g loading must be determined, to establish the adequacy of the attitude 
control loop during boost. The residual alignment offset is also required for the 
transfer of the prelaunch calibration information into the in-orbit alignment problem. 
Another possible candidate method, if necessary, would be the in-orbit IMU alignment 
verification. This is based upon the evaluation of gimbal angle data using a'set of 
known gimbal orientations with the system inertially referenced over several orbital 
periods. This method of gimbaled IMU in-orbit calibration for accurate attitude 
determination has been shown to be quite sensitive by a Draper Laboratory study 

performed to investigate fine attitude determination capability of a gimbaled system 

13 

for satellite application. 
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8.2. 1.1 Instrument Parameter Verification 


The three IMU instrument parameter verification programs are a minor modification 

1 4 

of the single IMU calibration program developed by Sperry Rand for NASA/MSFC. 
The modifications presently envisioned pertain to the I/O data handlers and the 
addition of a routine for printout of all calibration parameters determined. That 
is, the program will be made compatible with the MIT Processor Interface Unit 
hardware data formats. The program will also have the ability to compute, save 
and verify the following parameters for any one of the three IMUs. IMU selection 
can be either automatic or operator controlled. 

average gyro drift 
gyro torquing scale factor 
accelerometer low gain average bias 
accelerometer high gain average bias 
accelerometer low gain average scale factor 
accelerometer high gain average scale factor 

The verification is mechanized by measuring and filtering North and West velocities 
and the heading rate at thirteen automatically selected IMU positions. 

A Kalman Filter incorporates measurements of North and West velocity and the 
heading rate in estimating the following seven errors. 


DX, Y, Z 
MGX, Y, Z 
BLX, Y, Z 
BHX, Y 
KLX, Y, Z 
KHX, Y 


VN - North Velocity error 
VE - East Velocity error 
4 > n - Platform tilt abcut North axis 
tp - Heading error 
‘t'g - Platform tilt about East axis 


u> - Earth Rate 
e 

- North Gyro Drift 
“ E - East Gyro Drift 

- Azimuth Gyro Drift 


The filter operates at ten. second intervals after the platform has been stablized in 
one of thirteen positions. The filter is reinitialized for each position. The 
dynamic error model in this testing can be represented by the following equations: 

VN = -K VN + g<t> E (8-1) 

VE = -K VE - g<t> N (8-2) 
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1 + K 


<f> = 

‘AT 


YA 


N'^iT VE - ( ^ SinWE 


(8-3) 


0= K 54 VE + (u) e CosX)<J> E + K 47 uj u 


1 + 

E = VN + (to SinX)<l> - (u> CosX)0 


^ORTH 


N 


(8-4) 


(8-5) 


^ = 0 
= 0 


( 8 - 6 ) 

(8-7) 


The solution of the above equations is approximated by the vector difference equations; 

X = [f 1 X . where ri = 1, 2,.. .,10 seconds (8-8) 

— n l nj ~*n-l 

The state transition matrix is then 

(8-9) 

The linearized relationship between observables and state variables are; 


<J>(t + 10, t) = F 1q F ---Fj 


VN = VN 


meas 


VE = VE 


meas 


That is, 


where 


K 54 VE + ( % CosX) E ♦ K 47 ^ . 


Y = HX 

—meas — 


H = 


0 

1 

K 


0 0 
0 0 


0 0 
0 0 


54 


u> CosX 0 K 
e 


47 


Thus, at ten second intervals the following equations are evaluated. 

s' + I o“«* + >»- *>s n 
X=HX t+10 


( 8 - 10 ) 

( 8 - 11 ) 

( 8 - 12 ) 

(8-13) 


(8-14) 

(8-15) 
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(8-16) 


A 

<5M = Y - Y 


(Y are the measured velocities and heading rate) 


/ T 

p = <bp (b 

t + 10 t 


(P is state covariance matrix) 


K t + 10 = P t + 10 H 


H f'h T + R j ' 1 


(R is the measurement covariance matrix) 

7 


P T +10 P T + 10 " K t + 10 H P T + 10 


A 


A ' 


— t + 10 = ^t + 10 + K t + 10 — 


(8-17) 


(8-18) 


(8-19) 


( 8 - 20 ) 


The estimated states are now used in the verification sequences described below to 
estimate gyro drift and gyro scale factor prior to measuring accelerometer bias 
and accelerometer scale factor. 


Calibration Sequences and Positions 


Position #1 
UL 



Filter for at least 1800 seconds in position 1. Then store 
the following: 

DELUA = 0 
DN A = 

DUA = u> 

DZRA = DZRA + DUA (calibrate Z gyro drift) 


Position #2 


U. 


VJ 



Filter for at least 500 seconds 
DELUB =0 
DNB = -u> N 

DX = DNA - W g CosX(l - cos( DELUA) j 
DXR A =. DXRA + DX (calibrate X gyro drift) 
DY = DNB -u> e CosX(l - cos(DELUB)) 

DYRA = DYRA + DY (calibrate Y gyro drift) 


Position #3 
UL 



Filter for 500 seconds 
DELUC =0 
DNC = -w 
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Position #4 


U. 



DELUD = ^ 

DND =^0^ 

DELU2 = DELUB - 

DELU4 = DELUD + 


(DNA + PNC) 
2 Lu e CosX 

(DNA + PNC) 

2 CosA 


KGY = D ^ > CosA- 5 + 1/2 [ (cos < DELU2 )+ cos (DELU4))]" 1 
(relative change in Y-gyro scale factor) 


DY = -1/2 [(DNB + DND) (1 + A KGY) 

-(cos (DELU2) - cos(DELU4)G/ e cos>0] 


DELU1 = 


DELU3 = 


( 1 + AKGY) (DELUA - DY ) 
6/ e Cos A 

(1 + AKGY) (DELUA DY) 

Zu e CosA 


AKGX = D ^ A c : o GYC + 1/2 [cos (DELUl) + Cos (DELU3)]" 1 
(relative change in X-gyro scale factor) 


DX = 1/2 [(DNA + DNC) (1 + AKGX) 

- (Cos (DELU3) - Cos (DELUl))6o e Cos A.] 

MGX = KGX + (1 + AKGX) (calibrate X-gyro scale 

factor) 


MGY = KGY + (1 + AKGY) (calibrate Y-gyro scale 

factor) 


DXRA = DXRA + DX (refine X-gyro drift calibration) 

DYRA = DYRA + DY (refine Y-gyro drift calibration) 
measureAV^ in up position at lowgain 

CAPZU = AV Z 


Position 4. 1 Same as position 4, except Z gyro torqued with a square wave signal. 

Filter for at least 500 seconds 
DELU9 = ^ 

K9SEQ = 

DZRA = DZRA - (K9SEQ -l)^ e Sin^_ 

(refine Z gyro drift) 

KGZ = K9SEQ - KGZ 

(calibrate Z-gyro scale factor) 


Return to Level position 4 
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measure A V^, 

HXSQIO =AV X 
HYSQIO =AV y 


AVy over 100 seconds at high gain. 
^ High gain in level position 


Position #5 




Position #7 



Position #8 
a 



Position #9 
U. 




Measure AV^ over 100 seconds at low. high, low gains. 
X1SQ11 = AV^ Low gain at 3° above horizontal 
X2SQ11 = AV^ High gain at 3° above horizontal 
X3SQ11 = AVy Low gain at 3° above horizontal 


Measure AV v over 100 seconds at low, high, low gains. 
X1SQ12 = AV^ Low gain at 3° below horizontal 
X2SQ12 = AV^ High gain at 3° below horizontal 
X3SQ12 = AV^ Low gain at 3° below horizontal 

Measure AV y over 100 seconds at low, high, low gains. 
Y1SQ13 = AV y Low gain at 3° above horizontal 
Y2SQ13 = AV y High gain at 3° above horizontal 
Y3SQ13 = AVy Low gain at 3° above horizontal 

Measure AV y over 100 seconds at low, high, low gains 
Y1SQ14 = AVy Low gain at 3° below horizontal 
Y2SQ14 = AVy High gain at 3° below horizontal 
Y3SQ14 = AVy Low gain at 3° below horizontal 

This is an intermediate position in which no computations 
are made. 


Measure AV^ over 100 seconds in the down position using 
low gain. 


CAPZD = AV 


KLZ = 


Z 

2 SAT 


CAPZU - CAPZD 


(calibrate average Z-accelerometsr low gain scale 


factor 
BLZ = 


CAPZU + CAPZD 
2 AT 


KLZ 
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Position 10 





MeasureAVy over 100 seconds in down position 
using Low gain 

CAPYD = AV y 


Position 11 



Measure Av x over 100 seconds in the down position 
using Low gain. 

CAPXD =AV X 


Position 12 
U 



Position 13 


U, 



Measure AVy over 100 sec in the up position using 
Low gain. 

CAPYU =AxV y 

Kly = ^ S 

CAPYU - CAPYD 

(calibrate Y-accelerometer low gain average scale 
factor) 

KLY = -KLY (convert to east reference) 

ELY ■ (CAPY 2 U a -! t CAPYD) KLY 

(calibrate Y-accelerometer low gain average bias) 

Measure AV^ over 100 seconds in the up position 
using Low gain 

CAPXU = Av x 


KLX 


2 g AT 

CAPXU - CAPXD 


114 



(calibrate X-accelerometer low gain average scale 
factor) 


BLX 


CAPXU + CAPXD 
2 AT 


(calibrate X-accelerometer low gain average bias) 


_ ( X1SQ11 + X3SQ11) - (X1SQ12 + X3SQ12) 

2 (X2SQ1 1 - X2SQ12) 

(calibrate X-accelerometer high gain average scale 
- factor) ----- - - -- ------ 

„„ v ( Y1SQ14 + Y3SQ14) - (Y1SQ13 + Y3SQ13) 

" 2 (Y2SQ14 - Y2SQ13) 

(calibrate Y-accelerometer high gain average scale 
factor) 

BH x .( ksxJhxsqiz ) + BHX 

(calibrate X-accelerometer high gain bias) 

B H Y , (kHyJhYBQ 12 ) + BH y 
(calibrate Y-accelerometer high gain bias) 


With this last calculation, verification of this IMU is completed. The appropriate 
parameters are stored and displayed, and the procedure is repeated on the next 
IMU. 

During the entire test plan execution it is assumed that all calibration parameter 
results will be documented for continuing stability evaluation and analysis. 

8. 2. 1.2 Gimbal Chain Calibration 

An accurate attitude determination of the IMU stable member orientation with respect 
to a known body frame is of importance for rendezvous and entry performance as 
well as the verification of FDI initialization during prelaunch. The gimbal chain 
error sources consist of the synchro zero offset, readout errors over 360° at the 
A/D converter output, the gimbal offsets and non- orthogonality errors of all gimbal 
assemblies including the slaved fourth gimbal axis. 
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There is no proven method known to this author for calibrating the gimbal chains 
of the present air navigation subsystems at the ISS operating level. Historically, 
Apollo ISS was carefully calibrated and aligned to provide the capability of accurately 
pointing the stable member triad of accelerometers to perform the in-flight alignment 
of the subsystem stable member in a reference inertial frame established by the 
optical subsystem. The Apollo IMU calibration method is based upon establishing 
accelerometer axes in the local horizontal using a series of orientations of the 
gimbals when the ISS is mounted on a carefully calibrated positioning table. By 
zeroing the gimbal axes at a multispeed resolver null and establishing the local 
horizontal to attain specific accelerometer nulls using the fine positioning of a test 
table and compensating known instrument bias effects, it is possible to completely 
calibrate the stable member with respect to the ISS navigation base. The gimbal 
readouts are then calibrated by directly comparing the A/D output with a positioning 
table over 360° after the associated gyro loop is inertially stabilized. 

The angular calibration implementation described for Apollo is not directly 
transferable to the present ISS candidates since no accurate gimbal zeroing loop is 
available with the present synchros. These systems do, however, have an accurate, 
finely quantized accelerometer loop implementation which might be directly applied 
to the angular calibration problem. 

The calibration procedure for the gimbal readouts including the implemented A/D 
conversion electronics is relatively clear. It can be done by the ISS in the inertial 
mode (calibration axis perpendicular to earth rate) by compensating for earth rate 
and instrument uncertainties as well as possible, and then driving the gimbal axis 
in steps through 360° using a positioning table to reference the gimbal output readings. 
Another method would involve gyro torquing the calibration axis and simultaneously 
recording the gimbal output and the torquing history. This technique could be 
implemented entirely without the use of a positioning table and thus be available as 
a technique for pre-launch testing. 

Another gimbal readout calibration method involves maintaining the stable member 
in the local vertical mode while using vertical earth rate compensation to maintain 
the remaining axis inertially stabilized. Each gimbal axis would be stabilized in 
the vertical position in turn and the 360° gimbal calibration would then be ac- 
complished with either the vertical axis gyro torquing or the multiple table positioning 
methods. 

Notice that thus far, only the gimbal axis calibration has been addressed, calibration 
of the fundamental error sources associated with gimbal non-orthogonalities and 
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the stability of the synchro's zero reference, have not been considered. These error 
sources will certainly change between IMU assembly and ISS usage or whenever 
the ISS system is disassembled for instrument or electronic replacement. These 
errors may also be sensitive to temperature gradient changes from either the stable 
member controller or the outside environment. For example, in Apollo a single 
gimbal axis offset term would often change up to plus or minus two arc minutes 
due to reassembly of the gimbal axis hats. It should be noted that these error 
sources will remain to be analyzed after the multispeed resolver retrofit. 

An efficient way to isolate these error sources in the ISS operating configuration is 
to lock the gimbals in accurately known positions and utilize the accelerometers to 
establish the stable member position with respect to various gimbal axes. The 
number of test positions required must be sufficient to isolate the known orientation 
error terms. These terms will include the four gimbal axis non-orthogonalities, 
the four gimbal offset errors, the accelerometer misalignments with respect to the 
reference stable member triad, the accelerometer bias, and the appropriate fixture 
misalignments. This technique is similar to the one successfully implemented in 
the Apollo ISS testing. 

This testing method requires an external positional servo to electrically lock the 
gimbal orientations. This servo uses the amplified error voltage to derive an 
appropriate torque motor current for maintaining gimbal null. Testing is required 
in this area before the practicality of this approach is known. 

Another possible gimbal calibration method is to record the accelerometer triad 
orientation in the known gravity field, with the gimbal axis readouts. This data 
would then be used to solve the gimbal chain calibration equations without a 
requirement for the electrical gimbal lock. 

Data obtained during this testing phase must be documented. All error parameters 
must be evaluated for test stability and an investigation made to define the gimbal 
error compensation modeling -requirements. 

When a test procedure is defined and implemented it is anticipated that the acquired 
data will be outputted on the support typewriter. 

In review, the calibration of the gimbal axis readout and electronics about the compass 
rose is straightforward. Three approaches are outlined. The approach presently 
favored is to fine position the stable member in the earth frame, and appropriately 
compensate the inertially stabilized system while simultaneous recording the torqued 
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gimbal axes A/D output with the instrument torquing history. The calibration of 
the gimbal non-orthogonality and axis offset errors is not so straightforward and 
will represent a problem, which must be solved even after the multispeed resolver 
retrofit. Calibration test techniques must be investigated further, the development 
of a calibration technique without direct dependence upon the gimbal locking positional 
servo loop is required. 

8. 2. 1.3 Gimbal Flip Region Evaluation 

Another fundamental uncertainty in the use of a production type four-gimbaled system 
in the shuttle mission is the ability to operate normally in the region of gimbal 
flip. Throughout the multiple system simulations presented in this report it has 
been assumed that the ISS mountingis such that the normal outer roll axis is designated 
the orbiter pitch axis and the normal pitch axis becomes the orbiter yaw axis. 
This permits the defined azimuth axis to become the orbiter roll axis. The normal 
KT-70 gyrocompassing program may be used as the single two-degree of freedom 
accelerometer orientation is unaffected during prelaunch. This orientation is 
nominally free of "gimbal lock". Gimbal lock will occur only if the orbiter yaw 
angle becomes plus or minus ninety degrees with respect to the orbital plane. It is 
possible to keep the system from operating in the "gimbal lock" regions by using 
mission constraints but it should be determined if these constraints are even required. 
For example, is active management of attitude possible during gimbal flip? If not, 
simultaneous flip of all IMUs should be avoided, possibly by non colinear mounting 
of the IMUs. The problem of constraints is also of primary importance during two 
IMU operation where the orientations have been skewed to permit instrument axis 
voting. 

The basic testing task, then, is to determine whether any performance degradation, 
temporary or permenent, can occur because of gimbal flip. During flip, it is desired 
to obtain a continuous attitude indication and a performance evaluation of the inertial 
components. 

The gimbal flip region may be entered slowly or at a high angular velocity. The 
gimbal flip velocity will be a function of the conventional pitch angle 9 and the servo 
characteristics. Therefore, it is desirable to determine the gimbal angular velocity 
as a function of pitch angle and yaw gimbal rates. 

The proposed basic test technique is as follows: The system is initialized in the 

inertial frame with roll axis-north, azimuth axis-down, and pitch axes-east, along 
table trunnion axis. 
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The azimuth gyro will now sense the major component of gimbal velocity. The 
19.2 kc gyro preamp output of the azimuth gyro will be monitored during the test 
sequence using the automatic test point scanning capability of the SSCMS test facility. 
A near null signal during the maneuver would be an indication of flip integrity. 
Gyro data on the maximum pick-off output (i.e., at gyro stops) should be obtained 
from Kearfott prior to testing. Also monitored will be all the available gimbal 
A/D output data along with the slaved gimbal standoff angle. 

The test is performed in the following manner: First, the system is stabilized in 

the inertial mode, preferably with earth rate and other drifts being compensated 
via the digital torquer. The test table would now be" rotated about the trunnion axis 
(hence, changing the pitch angle proportionately) to a selected increment. Then, 
the table top would be rotated (simulating a yaw maneuver) to approximately 90° 
from its initial starting point. 

The test sequence in Table 8.1 is suggested as a starting point. The azimuth gyro 
error signal should be monitored on a fast response analogue recorder and the 
gimbal readout used for deriving gimbal'' rates over the monitoring interval. The 
gimbal loop fault monitoring system might also indicate if the gimbals are lagging 
the gyro error signals. 

Table 8-1 

First Second 

T.A. Position from Position R.A. + 90° 


Test No. 

Initial Point 

Via the Following Slewrate 

1 

-10° 

10°/sec. 

2 

o 

o 

CO 

10°/sec. 

3 

-50° 

10°/sec. 

4 

o 

o 

2°/ sec. 

5 

-90° 

2°/sec. 


The SSCMS will be used during this test sequence to provide a record of each test 
on magnetic tape for analysis. This tape will contain a simultaneous history of all 
four gimbal axis angles and rates, gyro error signals, and a record of table angles 
vs. time. This data may also be displayed at intervals on the HP2116B CRT. 

8.2.2 Gyro Compassing Multiple Systems 

The fundamental alignment program for the KT-70 system will be developed by 
Sperry Rand for NASA/MSFC."^ A revision to this program will be required for 
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multiple system gyrocompassing to provide vertical gyro torquing logic to zero the 
azimuth error. In addition to the I/O modifications identified earlier for hardware 
data format compatibility, the Ground Alignment sequence will be capable of 
simultaneous and independent alignment of up to three KT-70s. It is planned that 
the short term bias data from each IMU be calculated and automatically used for 
instrument compensation. This bias data will also be collected and analyzed. 

The automatic test station interface will be used in the gyrocompassing test phase 
for data acquisition and display. Data will be transferred from the 4 f-CP 2 to the 
test station using afixed format. Among the test parameter transferred are attitude, 
attitude rate and attitude error. These parameters as well as other test variables 
will be saved on magnetic tape for later analysis. Using the HP2116B CRT, the 
real time display of these parameters will be available. Figure 8.1 represents a 
possible CRT gyrocompass display. 

It may be required to convert the Sperry Code from floating point to fixed point 
arithmetic in order to reduce the real time load. 

8. 2. 2.1 System Testing 

This testing phase will verify the complete software implementation and hardware 
performance attained by gyrocompassing multiple systems. Initially, verification 
will be made on each IMU individually. This will be a single IMU test series to 
verify the X and Y gyro drift estimates, and the response time of the vertical erection 
and azimuth loops. After this single IMU testing a series of tests will be conducted 
to verify each IMU system is truly independent. This is done by checking the individual 
gyrocompass settle out residuals and response time in a multiple system 
implementation. In addition known instrument miscompensation can be applied to 
check the individual IMU offsets using the gimbal attitude information. 

8. 2. 2. 1.1 Single IMU G/C Verification 

6 

1. IMU instruments are to be recently calibrated . 

2. Put the IMU into normal G/C and allow the system to settle out. 

3. Use the capability to torque the stable member from the inertial mode 
to attain a known angular offset in three dimensions. Reinitialize G/C 
mode and carefully use the SSCMS facility to acquire a record of the 
gimbal angles vs. time on magnetic tape. Plots of loop response and 
settleout offsets can then be generated. This testing should be done 
with both initial positive and negative offsets to verify software. 
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Figure 8.1 - HP2116 Display (Gyrocompass) 
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4. Verify the X and Y short term drift compensation estimators by 
miscompensating the last instrument calibration value stored in the 
computer. 

8. 2. 2. 1.2 Multiple IMU G/C Verification 

1. Single IMU gyrocompass gimbal angle history should be available from 
prior testing. 

2. Run the multiple IMU gyrocompass program and verify that the gimbal 
angle history is unaffected during multiple system operation. This should 
give an indication of the status of the multiple IMU grounding quality 
as well as verification of independent software. 

3. Miscompensate the appropriate terms in a single IMU's instrument 
calibration stored in the computer and record on magnetic tape all gimbal 
angles as a function of time for later plotting and analysis. 

8. 2. 2. 2 Basic Ground Alignment Program 

The following is an explanation of the sequences and equations required to accomplish 

the ground alignment program. 

Sequence 0 


Condition for initiation: operator selection, ground align and system 

ready discretes are on. 

Purpose: to slew the platform -90^ from its flight orientation 


gyro torquing rate requirements: 


"y = ca e cos X - D yRA 
W x = ~ D XRA 


Sequence 1 


Condition for entry: 60 seconds to slewing have elapsed. 
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Purpose: to measure leveling errors, gyrotorquing rates requirements: 

“x = ” D XRA 

w y = w e COS x ' °YRA 
u, z =u> e sin X- D zra 

Measure velocity errors over 5 sec. 

5 

V y = K HY 2 AV y ' B HY 5 S6C 
At=0 

5 

V x = K HX 2 AV x " B HX 5 SeC 
At=0 

Compute level errors 

V 

0 = I 

0X1 g 5 sec 

V 

0 = x 

0Y1 g 5 sec 

Sequence 2 


Condition for entry: 5 seconds have elapsed in sequence 1. 
Purpose: torque out gross level errors, while still earth 

compensating. 


let At 

x 

At 

y 


p oxi 

“max ' ^’ D XRA^ 


7 0X1 


a) - (tu cos X - D,,„ . ) 
max e YRA 


rate 


Torque at maximum rate: 


X gyro for At x seconds 
Y gyro for At y seconds 


Torque remaining gyros for At sec where applicable, using 


<■0 = -D. 


XRA 


“'y ~ w e cos X - D yRA 
u, z =cu e sinX-D ZRA 
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Sequence 3 


Condition for entry: At seconds elapsed in sequence 2. 

Purpose: refinement of level. Gyro torque during computations at rate 
given by equation (8-22) over 15 seconds compute: 

NV ) - V (N 2 V )(£ N 3 ) 

X N IN 

N 2 )(£ N 4 ) - <£n 3 ) 2 


<2n*xI 

A x At / t- 


where At = 0.2 sec and N = 1, 2, . . . , N f with N^. At = 15 sec 
then let 

A 

0 OX3 = g 
A 

= 2L 

uY3 g 

Torque out these angles in the same way as Sequence 2 equations (8-25) and (8-26). 
Reiterate Sequence 3 sixteen times, unless operator has indicated otherwise. 


Sequence 4 

Condition for Entry: Sequence 3 has been iterated 16 times. 

Purpose: measure azimuth error and to further refine level. Gyro 

torque during computations at rates given by equation (8-22). Over 80 
seconds, evaluate equations (8-27) with NpAt = 80 seconds then compute; 

A 

= -2L 
0Y4 " ‘ g 

A 

0 =—Z. 

°0X4 g 

2B y 

^E4 = + <u e Sin X)6 0Y4 ),U} e cos X 

torque out 0 qx 4 as * n Sequence 2 equations (8-25) and (8-26). 
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Sequence 5 


Condition for Entry: angles have been torqued out. 
Purpose: to torque out azimuth error 


Periodically (At = 0.2 sec) compute horizontal velocity 

V x * K LX AV x " B LX Al ' K 2 V x 

V K LY AV y - - *2 V y 

update gyro leveling rates and torque X, Y gyros at 
K i v 

w = *y y - D 

x R XRA 


u) = u> cos X + K, — - n _ A 
ye lx R YRA 


Compute time to slew out azimuth error 


</» 


E4 


s uj _ & sin X 
max w e 


and perform azimuth slew for the period of time. 


Sequence 6 


Condition for Entry: azimuth error has been slewed out. 
Purpose: calibrate y-gyro drift. 

Torque gyros during computation at rate given by equation (8-22) 

over 200 seconds evaluate equations (8-27). 


then compute tilt angles and drifts 


S 0x6 

0 Oy6 





2B 
x 

g 


estimate Y drift 

D 200 

°YR " °Y " (W e COS X)(1 " cos ^E6 ) + (u e sin X)(0 Ox6 + ^~2 
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a failure will be indicated if 

°YR " °YRA > 1 de g/ hour 


Otherwise: 


D YRA = dyr 


Sequence 7 


Condition for Entry: calibrated Y-gyro drift variation is acceptable. 
Purpose: slew about azimuth to orientation shown below 


Derive X, Y torquing rates as follows. Compute V x and V Y from equation (8-30) 
and compute rates as: 


k iy v y 

w x = W e cos X R— " D XRA 


k iy v x 

“y = R D YRA 


Compute time to slew 

90° - (p 


t„ = 


E6 


1 u) - u) sin A 
max e . 


Slew about azimuth at max rate for t^ seconds 
Sequence 8 

Condition for Entry: Azimuth slew complete 
Purpose: platform leveling and stabilization 
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Set a = 0 Compute gyro torquing rates 


to x = u) g cos X cos a - 

w = cos X sin a - D, rri A 
y e YRA 

to = to sin. X - . 

z e ZRA 


Repeat Sequence 3 five times. 


Sequence 9 

Condition for Entry: sequence 3 has been iterated 5 times 
Purpose: calibrate X gyro drift 

Continue to torque using equation (8-37) 

Evaluate, over 200 seconds, equations (8-27) 

Compute tilt angles and drifts 



— X 

0x9 

g 

6 0y9 

II 

D = 

2B 
X 

X 

g 

D = 

2B 

X 

y 

g 


Compute total X-gyro drift 


D 200 


%R = D x ‘ (u, e cos - X)(1 ■ cos - "e sin X ( ®0y9 + ~-V“ ) 


An error condition exists if 

D XR ” D XRA <1 deg/hour 


Otherwise 


D XRA = °XR 


127 



Sequence 10 


Condition for Entry: X-gyro drift variation is acceptable 
Purpose: platform errection and prepared for Navigation 


Let 

^0x10 " ~ 0 Ox9 ' D x 200 
e 0yl0 = ~ e 0y9 " D y 200 
a = a + ^E9 


Torque out these angles using the procedure of sequence 2 (equations (8-25) and 
(8-26)) using the following rate definitions 


“x = “e cos ^ cos o - D xra 


^y = “e cos X sin Q " D YRA 
‘V^e sinX ' D ZRA 


Continue to earth rate compensate until operator selects new mode. 

8.2.3 Prelaunch Verification of Multiple Systems 

As discussed in Chapter 6 two methods are proposed to completely verify the 
performance within mission requirements of each IMU with respect to all operational 
IMUs. At least three cardinal positions are required to insure verification of all g 
sensitive as well as time dependent error sources. It is our present position that 
a six position test method be implemented for prelaunch verification. The six position 
test (flow gram in Chapter 6) is very closely associated with the IMU calibration 
both in data accumulation methods and in multiple positioning requirements. 

The testing of this method will consist of a complete calibration to insure very 
small uncompensated errors. This is followed by an evaluation of the mechanization 
of the six position method by introducing known instrument miscompensations and 
checking the verification method threshold values versus time. 

8.2.4 Land Navigation Performance Verification 

The land navigation program, developed by Sperry Rand, will operate from information 
provided by the velocity FDI. Each individual IMU output is compensated and data 
from all operational IMUs is averaged before utilization in the program. 
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The navigation program will integrate the delta velocity in an inertial coordinate 
system. Gyro torquing rates will be computed and mechanized to maintain all KT-70s 
in the inertial frame. It is presently assumed that vertical information will be 
clamped by the constant earth radius for laboratory fixed navigation. Periodically 
(every 2 seconds), latitude, longitude and heading will be computed for display and 
recording by the HP- 21 16b test station. A possible CRT display format for the 
land navigation phase is shown in Figure 8.2. This same data will be acquired on 
magnetic tape for subsequent analysis of navigation performance. 

8. 2. 4.1 System Testing 

This testing program will be principally self evident and directly depend upon the 
reasonability of performance in the output position and velocity error profiles. If 
the land navigation program validity becomes subject to question it can easily be 
verified by introducing known instrument compensation errors and verifying the 
average velocity error effects in the land navigation performance against documented 
sensitivities. 


8. 2. 4. 2 Land Navigation Program 

Condition for entry: the operator selects land navigation mode while the system is 
in the gyro compass mode. 


The three direction cosines are initialized as 


C = cos X cos a 
xx 0 

C n = -cos X sin a 
xyO 

C „ = sin a 
xzO 

Where a = the heading offset and X = the local latitude. Every major cycle (.2 sec) 
the velocity FDI computes the average horizontal delta velocity: 

AV x = average of operational IMUs <K LX X CApRI puLSES 
AV = average of operational IMUs (K 


- B lx 0.2) 


y 

These are integrated as. 


LY CAPRI PULSES 

- b Lx 0 -2) 


V (t) = V (t - 0. 2) + AV + 0. 2 |p + 2u> C } V (t - 0. 2) 
xx x ( z e xz» y 

0. 2 |p + 2w C }v 
’ y e xy’ z 
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Figure 8.2- HP2116 Display (Land Navigation) 
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Figure 8.3 - HP2116 Display (Debug) 
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V (t) = V (t - 0. 2) + A V - 0. 2 I P + 2u) C } V (t) 
y y y * z e xz > x 

+ 0. 2 Jp + 2u) C [V 

1 X e XX ’ z 

Where (vertical velocity) is determined either from external information (e.g. 
altimeter) or a canned profile. 


The velocities are then used to update the platform rates relative to the earth frame. 

2£C C V + (1 - 2£C 2 )V 
p = xx xy x _ xx ■ y 

X / . rt h V I i ! nn 


R( 1 - 2£) + h + 3R£C. 


xz 

2 


2AC C V + (1 - 2£C )V 
p xx xy y xy x 


R(1 - 2<£) + h + 3R£C. 


xz 


The altitude, h, is also derived from external information. 


C P + C P 
P = _ xx x xy y 

z C 

xz 


The three direction cosines are updated. 


= c 

+ 0. 2(C 

p 

- c 

p > 

XX 

xy 

z 

xz 

y 

= C 

+ 0. 2(C 

p 

- c 

p ) 

xy 

xz 

X 

XX 

z 

= c 

+ 0. 2(C 

p 

- c 

p ) 

xz 

XX 

y 

xy 

X 


Finally, the gyro torque rates for each major cycle are computed. 


u> - co C + P - D vtd . + D 
x e xx x XRA px 


co -or C + P - D-s/tjc . n 
y e xy y YRR + D, 


Fy 


co - CO C + P - Drrr, A + D 
z e xz z ZRA /vz 
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These are converted to period between pulses for the gypto output handler. 

Every 10 major cycles (2 seconds) an output cycle will commence to compute the 
following navigation parameters: 

IMU Heading: 



North and East velocity: 

V„ = -V sin a - V cos a 
Ex y 

V^ T = V cos o' - V sin a 
N x y 

Longitude: 

V cos a 

<f> = <f> + (2 seconds) — 

XX 

V ehicle heading: 

TH = <j> - a 

where is the azimuth gimbal angle. 

8.2.5 Failure Detection And Isolation Testing 

In the laboratory (one g environment) the FDI implementation must be verified for 
hard and soft failure conditions at both the three IMU and two IMU operating levels 
while insuring smooth transitionof velocity and attitude information during transfer 
between these operating levels. 
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The initial verification will insure that the hard failure reasonability levels have 
been successfully implemented to detect hard failure conditions prior to processing 
data from this error source. The soft fail implementation will use special red-line 
thresholds recognizing the laboratory environment. Verification of the computer 
software implementation for soft failure detection and isolation in powered flight 
will be verified with known instrument parameter miscompensations. The expected 
single IMU error propagation characteristics will be confirmed using the land 
navigator output recorded and displayed by the HP2116 facility. The system 
reconfiguration after failure isolation and the observed failure detection response 
time will also be recorded. The attitude FDI software implementation will be verified 
using gyro compensation errors designed to be demonstrated within reasonable time 
limits in the laboratory environment. L, 

8.2.6 Attitude Loop Demonstration 

It is desirable to demonstrate the attitude loop in terms of absolute angle readout 
since the attitude FDI mechanization in unpowered flight uses rate information from 
each IMU and is not sensitive to the absolute attitude. A desirable feature of this 
attitude loop resolution demonstration would displayand record attitude information 
from all individual systems as well as the total attitude loop information from the 
composite configuration. 

For the NASA/MSFC test demonstration the vertical axis seems most appropriate. 
A testing and demonstration sequence for the vertical attitude indicator s would consist 
of a plus and minus one degree vertical axis maneuver by the rotary table. A hard 
failure demonstration of the attitude FDI will be demonstrated by continuous torquing 
a single IMU axis. 

The land navigation results can give an excellent demonstration of soft failure detection 
and IMU data reconfiguration in the velocity FDI implementation. To attain this 
demonstration for the attitude FDI implementation, a soft failure of the gyroscope 
is introduced by a miscompensation along the vertical axis in a single IMU. This 
IMU drift will be detected both as an attitude error indication of the single IMU and 
to a lesser degree in the composite system. An attitude display on the HP2116 
CRT will then be used to demonstrate visually the FDI performance and the resulting 
system adaptation after error isolation. 

The display quantities would be the individual and composite whole angle information 
and the error angle information of each IMU with respect to the composite angle 
(see Figure 8.2). 
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9.0 LABORATORY TESTING HARDWARE AND SOFTWARE REQUIREMENTS 

9.1 HARDWARE REQUIREMENTS 

It has been proposed that the demonstration test system of multiple four gimbaled 
IMUs be implemented at the Marshall Space Flight Center. Assigned to this study 
are three Kearfott AN/ASN-90 (KT-70) Inertial Measurement Systems, an IBM 
4jr/CP2 and the SSCMS test facility including the Goerz 500 test table. This 
demonstration requires the design and implementation of appropriate interfaces to 
allow computer control and monitoring of the three inertial measurement systems 
and test equipment for data acquisition, storage and display, table control and readout. 

The AN/ASN-90 Inertial Measurement System consists of the KT-70 IMU, an Adapter 
Power Supply and a manual controller. In a multiple system laboratory test 
configuration it is desirable to have all moding under computer control. 

An appropriate AN/ASN-90 interface must provide for the handling of the following 
signals. 

9.1.1 Delta Velocity Pulses 

Plus and minus Delta Velocity (AV) output pulses from the IMU CAPRI 
electronics, for each of three accelerometer loops, can be best handled by an 
up/ down counter of appropriate size. This counter would accumulate net pulses 
over an update interval. Since the CAPRI electronics are asynchronous in 
nature, provision must be made for bit storage during counter readout. 
Presently, it is planned to use three 16 bit (capacity of several seconds of 

data) up/ down counters with single bit storage during readout as the accelerom- 
eter interface equipment. 

9.1.2 Gimbal Angle Outputs 

Gimbal angle outputs are in the form of three (Roll, Pitch, Yaw) three wire 
single speed synchro signals. These synchros have uncalibrated peak errors 
on the order of 5-7 arc minutes. 

Conversion of these synchro signals to digital binary form could be accom- 
plished using a single multiplexed converter or three dedicated converters. 
It is thought that the advantage of simultaneous gimbal angle data will outweigh 
the cost of the extra converters. The multiplex converter necessarily 
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introduces data staleness. To this end three dedicated tracking synchro to 
digital converters will be used. These converters will have an accuracy of 
14 binary bits (80 arc seconds) to provide sufficient accuracy to implement 
the IMU synchro calibration as discussed in chapter 8. 

9.1.3 System Input Discretes 

System input discretes are of two classes - gyro to torquing discretes (GYPTO 
commands), and other discretes (including analog torquing, accelerometer 
scale factor select, computer control, and moding discretes). 

9. 1.3.1 Gyro Torquing Discretes 

The gyros in the KT-70 IMU are torqued in a binary mode at a 200 pps 
rate. That is, the polarity of torquing signal must be supplied every 5 
milliseconds. This required command rate can be reduced by using 
ternary commands and providing a ternary to binary converter in the 
interface. This would provide binary commands (plus alternating with 
minus) in the absence of computer intervention. The computer could 
provide a pulse pattern for torquing over a period of time to reduce the 
load even further. Four bits of torquing information and a torque sense 
(sign) bit for each of the three gyro loops would require 15 bits of 
command information and a maximum of one word transfer per 20ms. 
If no torque other than binary is required no command need be made. 
This command could be implemented in a single 16 bit computer output 
word. 

The interface also requires an internal 5ms clock to operate the torquing 
interface. 

\ 

) 

9. 1.3. 2 Analog Torquing and Other Discrete Commands 

Provision must be made for the operation of analog slew and slew sense 
discretes for each of three axes (Xaxis, Yaxis, Azimuth) (6 lines). 
Several other input discretes must also be implemented. These include 
the accelerometer scale factor select discrete and mode selection 
discretes (Inertial, Normal, Ground Align). It is thought that these 
discretes could be implemented in a single 16 bit word. Discretes of 
this type are activated at a low rate and are not time critical. 
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9. 1 . 4 . System Output Discretes 


Several system output discretes must be input to the processor. These 
include IMS fail, system ready discretes and, possibly, some interface 
status and additional BITE information. Mode discretes are provided 
as an output from an AN/ASN-90 but, as manual moding is no longer 
provided, these are not implemented for the test system. Provision of 
a single 16 bit computer input word will be adequate for these signals. 
These output discretes also occur at a low rate and are not time critical. 


9.1.5. Avionics Interface 


In the aircraft installation an AN I ASN-90, magnetic variation and heading 
information are provided to the IMS in certain modes. This interface 
requires a synchro input and several discretes. These functions will 
not be used in the laboratory test and no provision will be made for 
their implementation. 

9.1.6. General 


It is thought that the multiple system interface would be provided as three 
identical interface units (IU), as described above. These units would be 
connected to the processor interface unit (PIU) by a multiplexing device using 
a serial bus. This processor interface unit would also contain provision for 
parallel transfer of information between the processor (IBM 4n7CP2) and the 
test station control computer (HP2116B). The processor interface unit would 
make use of the externally controlled input and output channels of the CP2 
along with an external interrupt and several input and output discretes. The 
PIU would do most of the I/O housekeeping and work into the computer on a 
cycle stealing basis. The test station interface, similarly, is externally 
controlled and provides access to the rotary table controls and readouts, the 
magnetic tape unit, the CRT display and to a line printer. 

9.2 SOFTWARE-EXECUTIVE CONTROL 

In chapter 8 certain laboratory test software requirements have been discussed, 
including calibration, alignment, gyrocompass, velocity FDI, attitude FDI, and land 
navigation programs. In addition to these, a number of service programs are required 
to enable efficient performance of the laboratory test sequences. These service 
programs will be identified as the executive program. 
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Since the 4/r-CP2 is essentially dedicated to three KT-70s, it seems appropriate 
that the executive will be the synchronous, box car type. The gyro torquing and 
navigation requirements make a .02 second minor cycle and .2 second major cycle 
attractive. It has been estimated that most periodic calculations will fit into minor 
cycles, if these calculations are done in fixed point and not in simulated floating 
point. For maximum flexibility, however, floating point arithmetic will be used 
where feasible. Provisions will be made for four background major cycles on a 
time available basis. An example of a background major cycle is the update of a 
Kalman filter. The major/ minor cycles will then be synchronized with the PIU by 

a. 02 second real time interrupt supplied by the PIU. This same interrupt will signal 
when either the CAPRI, synchro data, or any other data is available from the PIU. 
Discrete bits will be used to identify this interrupt. 

The coding for a complete multiple system test sequence will be capable of being 
stored entirely in memory at one time. The origin of the code will be magnetic 
tape, entered viathe HP2116 and transferred to the 4r/CP2 under PIU and executive 
control. Pertinent data will be sampled by the executive and tranferred to the HP2116 
for display and recording. The type and format of this data will be defined and will 
depend on the test sequence. Shown in Table 9-1 are some typical examples of 
data type and format. 

A test subsequence will be defined by specifying, for the major cycle, what routines 
will be called in each minor cycle. Thus, for each subsequence there will exist a 
list of ten address constants. When a subsequence is in control, its address list 
will be stored in the executive's transfer vector. Transition between subsequences 
will be affected by replacing the executive transfer vector with a new address list. 
This can only occur at the end of a major cycle. Operator communication with the 
executive and control of the test sequences will be through the keyboard, at a very 
low frequency. A test control program will exist as part of the executive. This 
program will decode keyboard messages, and format typewriter output. Keyboard 
messages will be simple commands. Examples of commands would be: 

a. Print Memory Location x 

b. Change Memory Location x to y 

c. Start Test Sequence x 

d. Stop Test 

e. Cause CP2 to Idle 

f. Change Instrument Compensation Values to Set x 
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TABLE 9-1 


Data Name 

Length 

Scale 

Subsequence 

Exploitation 

L AT. LON 

DP 

± it Rad 

N avigation 

Latitude & Longitude 

ALT 

DP 

(- 1000, +38000 )ft 

Navigation 

Altitude 

VN.VE.VU 

DP 

±1000 ft/ sec 

Navigation 

North, East and Radial Velocity 

* 

AVy 

DP 

±100 ft/ sec 

Velocity FDI 

Deviation from average velocity 

DET. 

] 

ISV. , 

1.3 

STATUS. 

1 

DP 

1 

o 

o 

Velocity FDI 

Detection Ratio, Velocity 

DP 

(0,1) 

Velocity FDI 

Isolation Ratio, Velocity 

DP 

0 or 1 

Velocity. & Attitude FDI 

Failure Status 

wy 

DP 

(0,200) meru 

Attitude FDI 

Estimate of error drift rate 

TSE. 

3 

ISR. . 

1.3 

OX. 

X 

DP 

(0,40000) meru^ 

Attitude FDI 

Total squared error 

DP 

(0,1) 

Attitude FDI 

Isolation Ratio, Attitude 

SP 

±.2 Rad 

Alignment & gyro compass 

X-tilt error 

OY, 

l 

SP 

±.2 Rad 

Alignment & gyro compass 

Y-tilt error 

oz. 

1 

SP 

±Y 1/2 Rad 

Alignment & gyro compass 

Azimuth error 

"u 

SP 

±70 meru 

All 

Average drift 

SF. . 

1.3 

ABIASH. . 
1.3 

ABIASL. . 
1.3 

ASFH. . 

1.3 

ASFL. . 

1.3 

CAP. 

1.3 

°i.i 

SP 

.5 sec /pulse 

All 

Gyro torque scale factor 

SP 

±.2 ft/sec^ 

All 

Acc. bias high gain 

SP 

±.2 ft/sec^ 

All 

Acc. bias low gain 

SP 

. 0004ft /sec /pulse All 

Acc. SF high gain 

SP 

.04 ft/sec^/pulse All 

Acc. SF low gain 

SP 

Integer 

All 

Sum of CAPRI pulses 

SP 

±n Rad 

All 

Gimbal angle 


*i=IMUl,2,3 *j =X,Y,Z 

The range or scale of the variables are subject to further definition. 
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Typewriter output will notify the operator of sequence transitions, error conditions, 
and changes in IMU moding. 

COM POOL (i.e. common data memory) is also considered part of the executive 
even though it does not contain instructions. This memory is accessible to all 
programs, including programs in different memory loads. In fact, its purpose is 
to provide a communication area for programs in different memory loads. The 
instrument calibration parameters are an example of the type of data stored in 
COMPOOL. Thus, the IMU calibration sequence communicates with the land navigation 
sequence via COMPOOL. 

9.3 COMPUTATIONAL REQUIREMENTS 

Computational requirements for the multiple IMU system are estimated in this section 
based upon three AN/ASN-90 IMUs working with a single 4^-CP2 computer. 

9.3.1 4r-CP2 Computer 

The IBM 4r-CP2 is a general purpose digital computer. It has 16K words 
memory, each with 32 bits. Sixteen bit half words in memory are augmented 
with parity and storage protection bits. The CPU has thirteen parallel 16 bit 
registers for arithmetic work and three index registers. There are two 
independent, 16 parallel bit I/O channels. 

Typical execution times for the CP-2 computer are given in Table 9-2. 

Table 9-2 - Command Execution Times 
in the CP- 2 Computer 


Command Time (/us) 


Input/Output Word 

4. 17 

Store Word 

2. 5 

Double Store 

5. 0 

Add , Load 

3. 75 

Double Add 

5. 0 

Multiply 

18.0 

Double Multiply 

20.0 
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9.3.2 Preliminary Estimates for Input/Output Operations 


1. AV Readout 

The accumulated AV pulses are frozen on command, and the three 
registers are read (estimated requirement one update/ sec). The required 
time is estimated at 50 as/s/IMU. 

2. Gimbal Angle Readout 

The estimated requirement is an update every other second. The gimbal 
angle readout requirements are estimated at 6 //s/s/lMU. 

3. GYPTO Decisions 

GYPTO loops must be commanded at 200 updates/s. It is assumed the 
binary torquing logic is left in the interface, and the three loops in each 
IMU can be commanded by a single half word (16 bit) transfer. Then 1 
ms/s/lMU will be required. For 3 IMUs, therefore, gyro pulse torquing 
I/O will require 0.3% of the computer. If the binary torquing logic is 
not implemented in the interface, considerable I/O duty cycle time will 
result. 

9.3.3 Preliminary Estimates of Computational Requirements 

A rough estimate has been made in Table 9-3 to define the 4r-CP2 requirements 
for the demonstration phase of this program. More specific estimates will 
be prepared when actual programs are available. 

Table 9-3 

4?7-CP2 Load Estimates - 3 IMUs 


Program 

Words 

% real time 

Gyro and Accl. Compensation 

1200 

7% 

Interface Requirements 

200 

1% 

Failure Detection (aV) 

500 

2% 

Failure Detection (Gimbal Angles) 

1200 

7% 

Gyro Compass and Navigation 

8000 

75%-100% 

Calibration 

11000 

40% 
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10.0 PRESENT WORK EFFORT SUMMARY 
The results of this study are summarized below: 

1. It is possible to establish reliable failure detection thresholds within 
normal variations of anominal mission for either gimbaled or strapdown 
redundancy. 

2. An FD1 philosophy applicable to "off the shelf" IMU technology has been 
defined and simulated providing high reliability compatible with FO/FO/ 
FS requirements in typical shuttle trajectories. 

3. Fundamental design considerations concerning the error signal magnitude 
required with respect to the level of noise on normal redundant information 
are established. This permits a definition of the performance level 
that can be isolated in a particular FDI implementation with known good 
reliability. 

4. Amultiple system prelaunch checkout method has been defined compatible 
with the shuttle goals of minimum system verification time. 

5. A system laboratory demonstration test plan is defined for hardware 
and software verification of this work. 

6. A system hardware interface definition for multiple IMU laboratory 
demonstration is defined. 

Further study is desirable in the following areas: 

1. A "once-around-abort" mission should be evaluated for FDI requirements. 

2. An analytical method to determine trajectory thresholds on the basis of 
terminal accuracy requirements only should be developed. 

3. Integrated redundancy management should be investigated to provide 
additional G&N information, e.g. radio aids, for increased decision 
reliability. 

4. Advanced statistical FDI techniques are presently available which enable 
a reliable decision capability in high noise fields. These techniques 
should be applied to this redundancy management problem. 

5. The present FDI implementation should be expected to include a diagnostic 
capability in software for non -critical time period instrument level fault 
detection and isolation. 

6. Continued evaluations to prove highly reliable FDI performance in the 
nominal entry mission are desirable. 

7. Continued two IMU FDI evaluations are desirable to prove reliable 
performance. 
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In general, the FO/FO/FS capability using colinear stable member alignment requires 
five IMUs to implement. The final approach selected using four IMUs includes a 
skew stable member orientation at the two IMU level. This permits voting on an 
instrument axis level for implementation of the fail safe criteria. 

A FO/FS capability is attainable with three IMUs either in a colinear or skewed 
stable member orientation. If a skewed orientation is utilized continuously from 
launch for three IMUs, several error sources not present in the colinear orientation 
become evident. First, independent gyrocompassing of each system will contain 
additional gyro torquing scale factor error sources. Another closely related error 
appears as a higher system noise level due to stable member orientation uncertainties. 
This attitude uncertainty, caused by gimbal axis errors as well as torquing errors, 
degrades the performance of the instrument orientation dependent FDI algorithm. 

In addition, the software required for implementing an FDI algorithm capable of 
handling a three IMU skewed system is much more complicated than for the colinear 

system. 

The inherent capability of a KT-70 IMU for FDI implementation using both colinear 
and skewed approaches will be carefully evaluated in both hardware and software 
during the laboratory demonstration program. 
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APPENDIX A 


A. 1 . REDUNDANT GIMBALED SYSTEM MODEL DEFINITION 

o 

This Appendix defines the actual AN/ASN-90 IMU and 4zr/CP2 computer system 
(which is to be implemented at MSFC) insufficient detail to evaluate gimbaled system 
failure detection and isolation methods. Both single and redundant IMU error models 
have been defined for simulations with shuttle vehicle trajectories. The IMU/system 
interface, which is left unchanged when employing an IMU in the multiple IMU system, 
is defined by a signal list. A tabulation of the critical design features required to 
permit failure detection and isolation in laboratory demonstrations, is also shown. 

A. 2 IMU ERROR MODEL FOR GENERAL FOUR GIMBALED SYSTEM 

This section of the Redundant System Model Definition describes a single IMU error 
model which is used as a building block in the digital simulation of the complete 
multiple IMU system. Areas of specific interest include: 

1. Definition of the stable member reference triad and determination of 
the orientation of the accelerometer and gyroscope input axes with 
respect to this reference triad. 

2. Definition of gimbal order. 

3. Definition of gimbal non- orthogonalities. 

4. Definition of gimbal angle readout chain errors. 

5. Attitude transformations. 

Not included in this model at this time are the servo characteristics: 

A. 2.1 Definition of a Reference Triad 

Since the KT-70 IMU is mechanized for local vertical frame navigation, the stable 
member reference triad has been defined using the two horizontal accelerometer 
input axes. 
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In the space shuttle orbiter application, where inflight alignment of the IMU is 
required, it is desirable to define the stable member triad axes in a known orientation 
with respect to the inner gimbal axis. Thus,' a known reference triad alignment 
can be obtained by the transfer of a known optical reference to the stable member 
axes by the use of the gimbal axis readout chain. 


The reference triad shall be a right-handed stable member fixed triad which, through 
rotation of the gimbals commanded by the computer, can be placed in arbitrary 
orientations relative to the vehicle (or laboratory) frame. 


To define the reference triad for the booster mission or for the purposes of the 
present feasibility demonstration, two axis horizontal accelerometer will be used 
to minimize earth frame alignment errors. The X and Y accelerometer input axes 
are leveled by nulling the accelerometer loop output with bias effects compensated. 


The definition of the reference triad is illustrated in Figure 1 as: 


X R " X AIA 

Y R - L f R in __ the X R Y A!A P lane 


Also shown in Figure 1 are three accelerometer alignment errors. The six gyroscope 
alignment errors, with respect to the defined triad, are shown in Figure 2. 


A. 2.1.1 Instrument Input Axes to Reference Triad Transformations 

The transformations from the accelerometer and gyroscope axes to the reference 
triad do not represent true rotations. Instead, they reflect the instrument axes 
into that triad. The matrices representing these transformations (see Figures 1 
and 2), are given below. 


X AIA 


X R 

y aia 

= 

R 

y r 

Z AIA 


_ Z R_ 

X GIA 


~ x r" 


G 


y gia 

= C 
'“'R 

y r 

Z GIA 


Z R 
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Letting Aj. represent the misalignment of accelerometer i about j^, and represent 


i] 


the misalignment of gyroscope i about j^, we have: 


ij 


-A 

"R 


or approximately: 


c A = 

C R 


-sin A yz 
sin A zy 


-A 


YZ 


0 

1 

-A, 


0 

cos A YZ 
-sin A zx 


0 

0 

1 


0 

0 


cos A zy cos A zy 


ZY “ZX 

Similarly, the gyro misalignment can be represented for small angles as: 

1 


,G 

"R 


B XZ B XY 


-B 


YZ 


1 


B 


B 


ZY 


-B 


ZX 


YX 

1 


Given these matrices, AV information quantized in the accelerometer frame may 
be transposed to either the reference (inertial) frame for navigation or if required 
to the gyroscope frame for compensation as: 

a T - 

V = C Y 

I R A 

— Q 4^ — 

V = C C V 

V G R R A 


A. 2.2 Gimbal Order and Gimbal Triads 


Proceeding from the stable member to the vehicle, the gimbal order defined by the 
KT-70 1MU is shown in Figure 3 as: 

Azimuth (stable member) gimbal (AZ) 

Inner roll gimbal (IR) 

Pitch gimbal (PG) 

Outer roll gimbal (OR) 

Navigation base (vehicle) (NB) 
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Angles between two adjacent frames are measured by a synchro mounted on the 
outermore gimbal. Positive angles are defined here about an outward pointing axis 
for purposes of laboratory testing. 

A. 2.3 Gimbal Non-Orthogonalities and Offset Errors 

It is desirable to model gimbals to reflect readout errors accurately since the 
proposed IMU model is used in studies of failure detection based upon attitude 
indication in multiple IMU systems. The attitude chain is also important in the 
problem of stable member alignment capability in earth orbit. This section will 
define gimbal non- orthogonalities and gimbal angle offset errors which appear when 
determining the relative orientation of the stable member with respect to the vehicle. 

Each of the gimbal reference frames contain an angular offset from their reference 
zero position due to the repeatability of the synchro zero reference. The non- 
orthogonality of successive gimbal axes are also separately modeled. These two 
angles are defined in Figure 4. Notice in this figure that is the gimbal offset 
error and .is the gimbal non-orthogonality errors where j denotes the appropriate 
gimbal axis. This definition closely re- resembles the gimbal definitions used in 
the Apollo Command Module IMU. 

The synchro offset is modeled as a constant bias term plus an angle dependent 
sinusoidal term. That is 

^ind ^mech e oj + sin ^mech ^off ^ 

where is the indicated angle, ^ mecll the physical (or mechanical) angle and A^ 
is the magnitude of the nx dominant synchro error term. </ j q ^ is the difference 
bet.ween mechanical and electrical zeros. 


A. 2 . 4 Gimbal Angle Readout Errors 

Error sources which are modeled as gimbal readout errors include the synchro 
offset errors previously defined and the additional A/ D converter errors due to 
linearization and quantization effects. For this initial definition the only additional 
readout error source will be due to quantization. The linearization errors will be 
sized when actual A/D converter designs are evaluated since A/D electronic designs 
are not included in the standard interface definition. 
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A. 2.5 Attitude Transformation 


A. 2.5.1 Attitude Transformation from the Reference to Body Frame 

The successive transformations from the reference triad to the body frame are 
functions of both gimbal angles and gimbal misalignments where gimbal angles are 
time varying, depending on body rotations and gyro drifts. 

In the absence of misalignments, each transformation represents a simple rotation, 
and may be exactly written in either the quaternion form or as a direction cosine 


matrix: 




1) Reference Triad to Azimuth Frame 

AZ 

q R 

or 

r AZ 
^ R 

2) Azimuth to Inner Roll Frame 

IR 

q AZ 

or 

r IR 

AZ 

3) Inner Roll to Pitch Frame 

PG 

q IR 

or 

r PG 

l ir 

4) Pitch to Outer Roll Frame 

OR 

q PG 

or 

p OR 

PG 

5) Outer Roll to Nav Base-Vehicle 

NB 

q OR 

or 

pNB 

OR 


Of these, number 1 is time independent, while 2, 4 and 5 vary with the gimbal angles 
<b, &p, as defined in Figure 3. The Inner Roll to Pitch transformation is constant 
except when the gimbals pass near, or through the gimbal flip region. In these 
regions, the inner roll gimbal angle, <5, can change widely and rapidly, depending 
on servo loop design, gimbal angles and body rates. The only general rule is that, 
near gimbal flip, gimbal motions are significantly larger than the vehicle motions 
which cause them. 

A.2.5.2 Attitude Transformations Using Readout Angles 

This series of transformations (section A. 2.5.1 above) represents actual rotations 
and is derived using true gimbal angles and misalignments. However, the true 
gimbal angle is never observable. A corrupted readout angle is available. The 
superposition of the synchro readout error means the computer will have available 
for attitude estimation and failure detection only similar transformations except 
that: 

for 0 AZ substitute 0 AZ - f QAZ + sin n(0 AZ - 0 QFF ) 
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for 0p substitute Bp 
for 0_ substitute 0 D 


C OPG + A 0P sin n( 0 PG ' 6 Pq FF ) 
c OOR + A 0R sm n( e R ' 6 R OFF ) 


A. 3 AN/ ASN 90 IMU ERROR MODEL 


This section of the system model definition is a discussion of the actual IMU Error 
Model being used, first, as a basis for digital simulation of a multiple IMU system 
and, second, as a standard in evaluating failure detection and isolation methods. 

A. 3.1 Mechanical Configuration 

Figure 3 shows a mechanical schematic of the four- gimbal inertial platform. Mounted 
on the inner gimbal are two two-degree-of-freedom gyroflex gyros, a two axis 
pendulous accelerometer, and a single axis pendulous accelerometer. One gyro is 
mounted with its spin axis along the vertical and provides pitch and roll stability. 
The second gyro has its spin axis along the positive pitch axis. One of its sensitive 
axes is along the vertical, while the other (providing a redundant input) is along the 
negative roll axis. The two axis accelerometer has its axes in the horizontal planes 
and the single axis instrument completes the triad. 


Mounted along the azimuth axis is a coordinate resolver which provides directional 
resolution of the gyro error signals sent to the pitch and outer roll gimbal servos. 
Attitude information is obtained from synchros mounted along the azimuth, pitch, 
and outer roll axes. The outer roll gimbal is slaved to the inner roll gimbal, but 
displaced by an angle of 90° about the roll axis. By this means gimbal lock is 
avoided and an all attitude capability is obtained. 

A. 3.2 Platform Orientation 


In normal operation, the AN/ASN-90 IMU's reference triad is oriented 


X R 


NORTH 

y r 

= 

EAST 

Z R 


DOWN 


Normal operation is in a local vertical mode. The redundant system feasibility 
demonstration program will use this IMU in an inertial mode, but will mount the 
system in the present aircraft orientation. It is to be noted that leveling the two 
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axis accelerometer with gimbal angles zeroed requires that the roll axes be 
horizontal. 


A. 3.3 Gimbal and Synchro Errors 

Kearfott specifications state all instrument input axes shall be within a cone of half 
angle 0.3 mr (la ) of their respective reference axes. The gimbal axis bias uncertainty 
angle of 0.6 mr (la) and gimbal nonperpendicularity of 0.6 mr (la) are considered 
typical. The magnitude of the sinusoidal synchro error is estimated to be less 
than 0.6 mr (la ). 

A. 3. 4 Inertial Component Error Models 
A. 3. 4.1 Gyroscopes 

The gyroflex gyroscope is a dry, flexure supported instrument. Sensitive to input 
about two axes, it has a two axis pickoff. Two orthogonal torquers reposition the 
gyro wheel to its null position. Separate windings are provided for analog and digital 
(compensation) torquing. One gyroflex has two "horizontal" input axes, nearly parallel 
to the IMU reference plane. The other is mounted with a vertical (or azimuth) IA, 
but has its second axis slaved to null. For this discussion, X and Y shall refer to 
the input axes of the horizontal gyro, and Z shall refer to the azimuth gyro. 

A model for the gyroflex, following that presented by Kearfott, is developed in the 
following paragraphs. 


A constant drift about each axis is assumed. This drift is denoted by 


°R = 


D 


RX 


D 


RY 


D 


RZ 


and has the units of rate (°/hr.). The sign convention assumed is that positive bias 
drift implies float rotation in the same sense as a negative real input rate. The 
sign convention for all other drift terms shall agree with this definition. 


Mass unbalance error terms have been defined by Kearfott. These correspond to 
drifts about the IA due to specific force along the gyro axes. Here, 
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M 


Oi’ 


= Spin axis mass unbalance term (°/hr/g), 

= Input axis mass unbalance term (°/hr/g), 

= Cross axis mass unbalance term (°/hr/g). 


where j=X, Y, Z. Mass imbalance drifts are given by 



w ux 


- M IX 

M ox 

_M sx 


a gx 

II 

ts 

W UY 

= 

-Mqy 

m iy 

m sy 


a gy 


w uz 


M oz 

M sz 

m iz_ 


a gz 


where A Q = C A 


Anisoelastic drift is the drift about the IA due to simultaneous linear accelerations 
along the SA and IA. The drift is given by 


W 


AX 


W A 


W 


AY 


* K AX J (a gy ) * a gz 

(K a v ) (A^ v ) (A, 


W 


AZ 


AY' 

C AZ } '“GX' '“GY 


GY '“GZ 
(K a -7) (A^y) (A, 


) 

) 

) 


where j=X, Y, Z, is given in°/hr/g 2 , and the specific forces are scaled in gs. 

Scale factor error is given by Kearfott in the form 


K AFj * K Wj <> + W 


where j=X, Y, Z. K F j is the loaded scale factor (sec/pulse) and K FE j is the scale 
factor error. K^ F j represents the actual gyro scale factor (sec/pulse). 

Random drift of the gyro is modeled as an exponentially correlated (Markovian) 
Gaussian noise. For each axis, 

At/ r , -2At / < 1/2 

Wjjj(t) = e W Rj (t-At)+ Gj (1 - e G J) N^t) 

where, j = X, Y, Z 


W_,(t-At) 


= random noise time at t 
= random noise at time At) 


At •= sampling time 
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r = correlation, time of gyro j random noise 
= standard deviation of noise of gyro j 
N.(t' = noise sample from a random Gaussian noise table with =1 and 


3 


mean = 0 


In Kearfott's model, r 


GX 


r GY 


= r Gz = i S ec and a QX = ^ 


a GZ = 0 - 003 °/ hr - 


This symmetry may be relaxed to allow differing t and <r values for each axis if 
W Ri is found to be a significant term. The three equations (W RX , W RY> W RZ ) will 
be started at different points on the Gaussian table. 


An analytical model of transients due to gyro warm up has been derived. It includes 
exponential terms with characteristic times of r = 1.3 and t = 20 minutes. These 
terms are excluded from the proposed model on the assumption that the IMU will 
be temperature for a period »3r before launch. Also excluded are non- orthogonality 
of pickoff axes and of torquer axes. 


The total drift is given by: 

W 

I 

W 


OUT 


OUTX 


W 


OUTY 


W 


OUTZ 


= d r + w u + w a +w r 


and the compensation torquing will be decided by 
W CMD = ” W OUT' = " j^R + W U + W A 

The maximum compensation range is ±50°/hr. Compensation torquing will introduce 
platform drift due to miscompensation of error terms, random drift and scale factor 
errors. 


A. 3. 4. 2 Two-Degree-of-Freedom Accelerometer 

A two axis (Kearfott 2414) accelerometer is used for the horizontal axes. This 
instrument is described as a dry, force-rebalanced, inverted flexure- joint pendulum. 
Displacements along two mutually perpendicular axes are detected by high gain 
capacitive pickoffs. Rebalancing is accomplished using two analog DC current 
permanent magnet torquers. The torquer current is digitized for use by the navigation 
computer. 
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Kearfott suggests modeling three error terms: constant bias along each IA, an 

acceleration independent scale factor error and random noise. Not suggested are 
scale factor linearity and crosscoupling terms. 

Bias is given in units of acceleration, B T ., i = X, Y. The scale factor error appears 

RJ 

as 


K ATj * K SJ (1 + K SEj'- j-X.'*' 

Here K c . is the loaded scale factor, and K™. is the scale factor error, 
oj bij 


The random noise is given by 


A Rj (t) e 


-At lr A . 


A„.(t-At) + r-A l - e 


— 2At jr 


1/2 


Rj 


Aj 


A h 


N.(t) 


where j = x, y 


A n .(t) = random noise at time t 
Rj 

A^.ft-At) = random noise at time (t-AT) 
Kj 


At 

r 


Aj 
a Aj 
Nj (t) 


= sampling time 

= correlation time of accelerometer random noise 

= standard deviation of accelerometer random noise 

= Noise sample from a Gaussian noise table with a = 1 
and mean = 0 


The total sensed specific force then is given by (units are AV pulses/ sec): 

A, 


(A. . - g. + B t . + A.-, .) 
. - in.T s i Li R,i 

OUT] <K Sj ) (1 + 


SE j 


If required, a more detailed model would include scale factor nonlinearity and cross 
coupling given by: 


OUTj 
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1 a cxy 
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Nominal Value or 


Term 

General Platform 
Model Nomenclature 

Representative 
Error (lcr) 

Equivalent Channel Drift 



Horizontal Gyro 

D RX’ d ry 

0. 01°/hr 

Azimuth Gyro 

d rz 

0. 01°/hr 

GYPTO/Torquer Scale Factor 



Horizontal Gyro 

K FX' k fy 

0. 4 sec /pulse 

Azimuth Gyro 

k fz 

/ 

0, 4 sec /pulse 

GYPTO/Torquer Scale Factor 



Horizontal Gyro 

k fex* k fey 

300 ppm 

Azimuth Gyro 

k fez 

300 ppm 

Mass Unbalances 



Horizontal Gyro Spin Axis 

M SX’ m sy 

0. 05°/hr/g 

Azimuth Gyro Spin Axis 

M sz 

0, 05°/hr/g 

Horizontal Gyro Input Axis 

M IX' m iy 

Negligible 

Azimuth Gyro Input Axis 

m iz 

Negligible 

Horizontal Gyro Cross Axis 

M OX’ m oy 

TBD 

Azimuth Gyro Cross Axis 

M oz 

TBD 

Anisoelasticity 



Horizontal Gyro 

K AX’ k ay 

Negligible 

Azimuth Gyro 

k az 

Negligible 

Random Drift 



Horizontal Gyro 

w w 

vv RX RY 

7 GX = r GY = GZ =0 ” 003 deg/hr 

Azimuth Gyro 

w 

RZ 

r GX =7 GY GZ =1 Sec 


Long Term 




General Platform 

Representative 


Term 

Model Nomenclature 

Error (ltr) 


Accelerometer/CAPRI Bias 




Horizontal Accelerometer 

b lx* b ly 

0. 067 cm/s^ 


Vertical Accelerometer 

b lz 

0. 100 cm/ s^ 


Accelerometer/CAPRI Scale Factor 


Low Gain 

High Gain 

Horizontal Accelerometer 

K SX' k sy 

1 . 0 cm/s/pulse 

0. 01 cm/s/pulse 

Vertical Accelerometer 

K sz 

1 . 0 cm/s/pulse 

0. 01 cm/s/pulse 

Accelerometer/CAPRI Scale 




Factor Error 




Horizontal Accelerometer 

k sex* k sey . 

267 ppm 


Vertical Accelerometer 

k sez 

300 ppm 


Accelerometer/CAPRI Scale 




Factor Nonlinearity 




Horizontal Accelerometer 

k lex # k ley 

TBD ppm/g 


Vertical Accelerometer 

k lez 

TBD ppm/g 
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Term 

General Platform 
Model Nomenclature 

Representative 
Error (la) 

Accelerometer Cross Coupling 

A 

CXY 

TBD 


A 

cxz 

TBD 


a cyx 

TBD 


A 

^CYZ 

TBD 

- 

_ _a _ 

CZX 

TBD 


A 

CZY 

TBD 

Accelerometer /CAPRI Random Noise 


Short Term 

Horizontal Accelerometer 

a rx* a ry 

T - T - T =0 v 1 n~ 5 

AX AY AZ ^ X1U 

Vertical Accelerometer 

> 

so 

IN 

Effectively White Noise 

Misalignments 



X-Gyro About 

b xy 

2.9x10 4 rad 

X-Gyro About Z^ 

B xz 

2. 9x 10' 4 rad 

Y-Gyro About X^ 

b yx 

2. 9 x 10" 4 rad 

Y-Gyro About 

b yz 

2. 9 x 10' 4 rad 

Z-Gyro About X^ 

b zx 

2. 9 x 10" 4 rad 

Z-Gyro About Y^ 

B Z Y 

2. 9 x 10 -4 rad 

Y-Accelerometer About X^ 

a yx 

2.9x10 4 rad 

Z -Accelerometer About X^ 

a zx 

2.9x10 4 rad 

Z -Accelerometer About Y~ 

rt 

a zy 

2. 9 x 10 -4 rad 
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K 


represents scale factor nonlinearity, while represents cross-coupling of 
input along j into the output of accelerometer i. 


A. 3. 4. 3 Single- Degree- of- Freedom Accelerometer 

A single axis (Kearfott 2404) accelerometer is used on the vertical axis. It is a 
dry, force rebalanced, inverted flexure-joint pendulum. In general, its description 
is the same as that of the (2414) two axis accelerometer. 


Error terms in the single axis instrument are identical with those of the two axis 
instrument. Indeed, if j is understood to be j=X, Y, Z, and the cross- coupling matrix 
is rounded out to 


1 

a cxy 

A 

cxz 

A 

CYX 

1 

A 

CYZ 

A CXZ 

A 

CYZ 

1 


the equations of the previous section will cover the triad of accelerometers. 
D. Estimates of Instrument Uncertainties 


Kearfott has provided estimates of the bulk of instrument error parameters 
needed for this model. In the table which follows, nominal scale factor values 
are given. All other terms are one sigma error estimates. "TBD" or "to be 
determined" means simply that no estimate is given in the published material 
now available. 


A-IV Multiple IMU System Model 


The single IMU error model has been defined. A model of a multiple IMU system 
is being constructed using the single IMU model as a building block, and subject to 
system definition ground rules described in this section. 

Feasibility of a multiple IMU inertial system is to be demonstrated in this program. 
The system is to conform to these general rules. 

1) The system will contain 4 four-gimbaled IMUs, mounted on a common 
navigation base. They will have coplanar gimbal axes. 
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2) There will be a central computer which, among its functions, will perform 
failure detection and isolation. 

3) .The system is to be FO-FO-FS. 

Four identical IMU's will be used. For the demonstration program, they shall be 
off-the-shelf Kearfott AN/ASN-90's. All individual inertial systems are assumed 
to be commonly mounted on a single navigation base. Consideration will be given 
to other IMU's and to alternative AN/ASN-90 gimbal arrangements. Further, a 
study of non-coplanar IMU axes mounted orientations will be made at a later time 
in this study effort. 

A-v KT-70 Electrical Interface Definition 


The interface to the AN/ASN-90 IMU and its associated electronics carries both 
power and signal lines. It should be noted that signal voltage levels are specified 
atthelMU. With the system mated with other than the dedicated AN/ASN-90 computer, 
an interface unit will have to be designed to mate these signals to the given system 
interface unit/data bus/computer complements. 


A. IMU and Electronics Power Requirement 


1. 115V, 400 Hz, 30 

2. 26V, 400 Hz, 0C 

3. 5V, 400 Hz 

4. 28 VDC 


4 wire, 940 watts (max) 
6 watts 
7.5 watts 
10 watts 


The proposed laboratory test system will employ the A- 7 adapter power supply 
for each IMU. 


B. IMU Signals to the Computer 


1. Discrete Status Signals 

Each IMU will have available the following discrete status signals: 

IMU Fault Warning IMU Fail = Logic "1"* 

System Ready IMU Ready = Logic "1"* 

* Converse is true for logic "0". 
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Here, and in the following pages, logic "1” = 5±1 VDC, logic "0" = 0±0.5 VDC. 
Noise levels on logic lines must be under 1 volt. 

In addition to these discretes, there is a multiposition "mode" switch. Modes 
mechanized in the AN / ASN-90 system include Ground Align, Inertial, Normal (Local 
Vertical Navigation), Magnetic Slave and Grid. 

2. Analog Data Signals 

There will be three single speed synchros, mounted on the outer roll, 
pitch and azimuth gimbal axes, in each IMU. Synchro to digital conversion 
(S/D) will be performed by a yet to be specified gimbal angle readout. 
The synchros will have 3 wire outputs and will be characterized by 

Null * 0.035 V 400 Hz 

Gradient at Null 0.185 V/° 400 Hz 

Max. Output 10.5 V > 400 Hz 

3. Digital Data Signals 

Digital output to the computer will comprise AV pulses only. Six dedicated 
pairs of wires will carry these six signals: ±AV X> ±AVy and ±AV Z> 

Pulse characteristics are given by: 

Pulse Rate 
Pulse Width 
Logic "1" 

Logic "0" 

Pulse Time Constants 
Currents 

C. Computer Output Signals (Commands) 

1 . Discrete Signals to IMU 

Pulse shape for all Discretes 

Computer Fault 


IMU 2 mA sink either state 
T r . T f = 10 us max 
All signals are single -ended 
Computer fail = Logic "1" 


0 - 10,000 pps 
13 ±12 /us 
5 ± 1 VDC 
0 ± 0.5 VDC 
T„, T„max = 3 us 

K r 

3 mA sink at Logic "0" 

0.05 mA source at Logic "l" 
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Autocal in Progress 
Computer Control 
Accel. SF Change 
AZ Slew (90°/min) 

X Slew (30°/min) 

Y Slew (30°/min) 

AZ Slew Sense 

X slew Sense 

Y Slew Sense 


In Progress = Logic "l"' 

Accept Computer Control = Logic "1" 
Change SF = Logic "1"* 

Slew Command = Logic "1" 

Decreasing True Hdg CX = Logic "1"* 
With True Hdg CX at 0°, Decreasing 
Roll CX = Logic "l u * 

With True Hdg CX at 0°, Decreasing 
Pitch CX = Logic "1"* 


* Converse is true for Logic "0". 

Note that "X Slew" and "Y Slew" refer to slewing about the X and Y 
gyro input axes, respectively. No provision is made for slewing about 
the outer roll or the pitch axis alone. 


2. Gyro Pulse Torquing Signals 


Gyro pulse torquing for drift compensation, earth rate compensation 
and motion compensation (used for maintaining the local vertical frame) 
is commanded by the flight computer. Signals needed are: 


GYPTO Logic, W x 
GYPTO Logic, W y 
GYPTO Logic, W z 


Pulse Train 
200pps 

Pulse Width = 5000 us 

Current Requirements = 3 mA max 


GYPTO Clock Pulses Pulse Rate = 200 pps 

Pulse Stability = 100 ppm 
Pulse Width = 1 a/s at 4 VDC 


A-VI. Critical Design Feature Definition 


Several design features of the AN/ASN-90 IMU have been identified as critical to 
the demonstration program. That is, normal performance of these system features 
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may be marginal for a complete demonstration of failure detection for the space 
shuttle. 

A. Gimbal and Gimbal Angle Readout Problems 

There is a general problem of gimbal accuracy requirements with respect to inflight 
alignment and failure detection. Angle readouts are presently limited. To modify 
the system would require changing the gimbal accuracy specification or developing 
anew calibration technique. Single speed synchros should be replaced, and additional 
temperature control provided. 


All synchros should be read as close to simultaneously as possible. If individual 
tracking S/D converters are used (three per IMU or nine in all), then it is possible 
to read all synchros 50 times/second. If an attempt is made to multiplex syncnro 
outputs and use a single S/D converter, reading all angles will require 900 ms 
(update/sec). Therefore, nine individual, tracking S/D converters are suggested. 

B. IMU Mounting 

A mounting orientation of KT-70 in the shuttle vehicle for both pre-launch 
gyrocompassing and avoidance of gimbal flip during boost requires further careful 
study. 

IMU case isolation pads cause a possible problem for gimbal angle failure detection 
on a common navigation base. 

1 . Accelerometer Counters 

The two AV loop is presently unsynchronized with accelerometer counter 
readings. 

All accelerometer counters should be frozen simultaneously and read 
in a time less than the time required for two pulses from any ac- 
celerometer. This assumes that the one bit sensing circuitry is designed 
for no fault operation. This is different from a single KT-70 interface 
where accelerometer counters are frozen and read sequentially. 
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D. GYPTO Computer Requirements 


The requirement for GYPTO inputs every 5 ms is out of proportion with the number 
of data transfers needed for velocity and gimbal information. This is in no way a 
serious problem using a parallel interface, as is envisioned, but would cause 
congestion on a serial bus such as might be used in a flight vehicle application of 
multiple systems and redundant computers. It is, therefore, recommended that the 
binary torquing be handled by circuitry in the interface. This will not limit the 
ability to compensate for errors. It will simply reduce the computer overhead for 
handling compensation to actual net torquing. 

A-VII. Summary 

This Appendix is an effort to gather baseline information on the KT-70 IMU in a 
single source. A model of the IMU and its inertial components is given and 
complemented by estimated parameter values. The electrical interface at the IMU 
is described, although no attempt to describe the proposed system mechanization 
is made. 
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B. ' Flow Chart of the Multiple IMU System 
B. 1 Introduction 

The digital model of the multiple IMU system is explained by an anotated 
flow chart. This description includes the logic for both the single 
position tests described in Chapter 6. A glossary follows the flow chart. 



169 







170 









m 


FDI A Test 
XFIagu^ 


Go to DELV 


POSNODD 
K ? x 


Yes 

DELV 


X is ^ 
t > 120 
v sec 


AV(t) = AV ( t - At ) ♦ 

At ( ASFM ) ( AB -ACRCA/VUS CJK g^) 


FDI 

Jest Flag 
\up > 

NoT 


Go to FDI 


I Fourth Order 
Runge - Kutta integration of 
D iff Eq. for Gimbal Angles.- 

GANG ^CRESV.IBD - GMIS 
CJKWIEl - CGSD GMIS 


FDI 

Test Flag 

'PX 


>2040 sec 


Calculate Y_- Vectors 
WX,WY,WZ from 
6ANG. GANG„ 


m 









More 



172 














FDI 



173 



























Page intentionally left blank 


a * 


GLOSSARY 


BD 

* 

CGSD 


mis 


* 

A - 
mis 

AB 


A 12- vector of gyro acceleration insensitive drifts. 
A 12 x 12 matrix modeling gyro g sensitive drifts 


G 1 

o 

o 

O 

where O is a 3 x 3 

zero matrix 

o 

G 2 

o 

O 


and Gj 

is given by 

j—i 


o 

o 

G 3 

O 


-M. . 

1X1 

M 

0X1 

M . 

SXl 


o 

o 

O 

G 4- 


-M 

oyi 

m t . 
iyi 

M 0 • 
syi 






M . 
__ ozi 

M . 

SZl 

ML . 

lZi_ 






Here, 

1 f are the g sensitive drift 


M si> 

M oi 


terms about a given axis 
due to linear acceleration 
[ along the 


input 

spin 

cross 


axis. 


A 12 x 12 matrix modeling gyro sensitive axis misalignments 
about the platform reference axes. 



A similar matrix modeling accelerometer misalignments. 
A 12- vector or accelerometer biases. 
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AC RC 


ASFM 


A 12 x 12 matrix representing accelerometer measurement and 
cross coupling errors. 


A 1 

o 

o 

o 

o 

A 2 

o 

o 

o 

O 

A 3 

o 

p 

o 

o 

A, 


where 


A i 


1 

A 

cxy 

Acxz 

A 

cyx 

1 

Acyz 

A 

A 

1 

czx 

czy 



A 12 x 12 diagonal matrix consisting of factors of the form 
K s ( 1+K SEij) 


where Kg Eij 
i = x, y, z. 


is the SF error of the ij accelerometer axis, 
j = 1, 2, 3, 4 
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